history-museum/Clash.Meta
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: http/https proxy authentication (#1613)

Browse Source
This commit is contained in:
Xuen Li 2021-09-14 00:08:23 +08:00 committed by GitHub
parent 55600c49c9
commit f5806d9263
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
listener/http/proxy.go
View File

@ -63,8 +63,8 @@ func HandleConn(c net.Conn, in chan<- C.ConnContext, cache *cache.Cache) {
request.RequestURI = "" request.RequestURI = ""
RemoveHopByHopHeaders(request.Header) removeHopByHopHeaders(request.Header)
RemoveExtraHTTPHostPort(request) removeExtraHTTPHostPort(request)
if request.URL.Scheme == "" || request.URL.Host == "" { if request.URL.Scheme == "" || request.URL.Host == "" {
resp = responseWith(http.StatusBadRequest) resp = responseWith(http.StatusBadRequest)
@ -74,9 +74,9 @@ func HandleConn(c net.Conn, in chan<- C.ConnContext, cache *cache.Cache) {
resp = responseWith(http.StatusBadGateway) resp = responseWith(http.StatusBadGateway)
} }
} }
}
RemoveHopByHopHeaders(resp.Header) removeHopByHopHeaders(resp.Header)
}
if keepAlive { if keepAlive {
resp.Header.Set("Proxy-Connection", "keep-alive") resp.Header.Set("Proxy-Connection", "keep-alive")
@ -98,7 +98,7 @@ func HandleConn(c net.Conn, in chan<- C.ConnContext, cache *cache.Cache) {
func authenticate(request *http.Request, cache *cache.Cache) *http.Response { func authenticate(request *http.Request, cache *cache.Cache) *http.Response {
authenticator := authStore.Authenticator() authenticator := authStore.Authenticator()
if authenticator != nil { if authenticator != nil {
credential := ParseBasicProxyAuthorization(request) credential := parseBasicProxyAuthorization(request)
if credential == "" { if credential == "" {
resp := responseWith(http.StatusProxyAuthRequired) resp := responseWith(http.StatusProxyAuthRequired)
resp.Header.Set("Proxy-Authenticate", "Basic") resp.Header.Set("Proxy-Authenticate", "Basic")
@ -107,7 +107,7 @@ func authenticate(request *http.Request, cache *cache.Cache) *http.Response {
var authed interface{} var authed interface{}
if authed = cache.Get(credential); authed == nil { if authed = cache.Get(credential); authed == nil {
user, pass, err := DecodeBasicProxyAuthorization(credential) user, pass, err := decodeBasicProxyAuthorization(credential)
authed = err == nil && authenticator.Verify(user, pass) authed = err == nil && authenticator.Verify(user, pass)
cache.Put(credential, authed, time.Minute) cache.Put(credential, authed, time.Minute)
} }

16
listener/http/utils.go
View File

@ -8,8 +8,8 @@ import (
"strings" "strings"
) )
// RemoveHopByHopHeaders remove hop-by-hop header // removeHopByHopHeaders remove hop-by-hop header
func RemoveHopByHopHeaders(header http.Header) { func removeHopByHopHeaders(header http.Header) {
// Strip hop-by-hop header based on RFC: // Strip hop-by-hop header based on RFC:
// http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.5.1 // http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.5.1
// https://www.mnot.net/blog/2011/07/11/what_proxies_must_do // https://www.mnot.net/blog/2011/07/11/what_proxies_must_do
@ -32,9 +32,9 @@ func RemoveHopByHopHeaders(header http.Header) {
} }
} }
// RemoveExtraHTTPHostPort remove extra host port (example.com:80 --> example.com) // removeExtraHTTPHostPort remove extra host port (example.com:80 --> example.com)
// It resolves the behavior of some HTTP servers that do not handle host:80 (e.g. baidu.com) // It resolves the behavior of some HTTP servers that do not handle host:80 (e.g. baidu.com)
func RemoveExtraHTTPHostPort(req *http.Request) { func removeExtraHTTPHostPort(req *http.Request) {
host := req.Host host := req.Host
if host == "" { if host == "" {
host = req.URL.Host host = req.URL.Host
@ -48,8 +48,8 @@ func RemoveExtraHTTPHostPort(req *http.Request) {
req.URL.Host = host req.URL.Host = host
} }
// ParseBasicProxyAuthorization parse header Proxy-Authorization and return base64-encoded credential // parseBasicProxyAuthorization parse header Proxy-Authorization and return base64-encoded credential
func ParseBasicProxyAuthorization(request *http.Request) string { func parseBasicProxyAuthorization(request *http.Request) string {
value := request.Header.Get("Proxy-Authorization") value := request.Header.Get("Proxy-Authorization")
if !strings.HasPrefix(value, "Basic ") { if !strings.HasPrefix(value, "Basic ") {
return "" return ""
@ -58,8 +58,8 @@ func ParseBasicProxyAuthorization(request *http.Request) string {
return value[6:] // value[len("Basic "):] return value[6:] // value[len("Basic "):]
} }
// DecodeBasicProxyAuthorization decode base64-encoded credential // decodeBasicProxyAuthorization decode base64-encoded credential
func DecodeBasicProxyAuthorization(credential string) (string, string, error) { func decodeBasicProxyAuthorization(credential string) (string, string, error) {
plain, err := base64.StdEncoding.DecodeString(credential) plain, err := base64.StdEncoding.DecodeString(credential)
if err != nil { if err != nil {
return "", "", err return "", "", err