External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(proxy): accept transparent redirected connections

Browse Source 
The proxy only accepted explicit clients, which announce their
destination with a CONNECT request. A client whose connection is
redirected at the kernel level speaks TLS immediately instead, so
http.Server tries to parse a TLS record as an HTTP request line and
drops the connection.

Demultiplex on the first byte of an accepted connection. A TLS
handshake record (0x16) cannot begin an HTTP method, so it separates
the two cleanly. Redirected connections have their destination
recovered from the ClientHello SNI and are served by synthesising the
CONNECT the client never sent, which keeps the MITM decision, cert
generation and interceptor chain on the existing code path.

Redirected connections deliberately bypass http.Server. It issues a
background read while a handler runs, which consumes the first byte of
the replayed ClientHello and corrupts the handshake. The CONNECT
response is also suppressed, since a client mid handshake expects a
ServerHello and would read those bytes as a malformed TLS record.

Off by default. Enabled with `pmg proxy start --transparent` or
proxy.server.transparent, and only useful alongside a redirect
mechanism such as an eBPF connect rewrite.
This commit is contained in:
Sahilb315
2026-07-27 12:31:24 +05:30
parent b8e12c27ae
commit 82ddbc70af
7 changed files with 540 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/proxy/start_test.go
+24 -1
View File
@@ -17,7 +17,7 @@ func TestDaemonArgsPrependsChangedConfigFlags(t *testing.T) {
start := &cobra.Command{
Use: "start",
Run: func(cmd *cobra.Command, _ []string) {
got = daemonArgs(cmd, "/tmp/proxy-state.json", "127.0.0.1", 9000)
got = daemonArgs(cmd, "/tmp/proxy-state.json", "127.0.0.1", 9000, false)
},
}
proxyCmd := &cobra.Command{Use: "proxy"}
@@ -37,5 +37,28 @@ func TestDaemonArgsPrependsChangedConfigFlags(t *testing.T) {
"--state", "/tmp/proxy-state.json",
"--host", "127.0.0.1",
"--port", "9000",
"--transparent=false",
}, got)
}
// The daemon re-execs itself, so a transparent value supplied by flag must be
// carried across explicitly. The child's own config load cannot see it.
func TestDaemonArgsCarriesTransparentToChild(t *testing.T) {
root := &cobra.Command{Use: "pmg"}
config.ApplyCobraFlags(root)
var got []string
start := &cobra.Command{
Use: "start",
Run: func(cmd *cobra.Command, _ []string) {
got = daemonArgs(cmd, "/tmp/proxy-state.json", "127.0.0.1", 9000, true)
},
}
proxyCmd := &cobra.Command{Use: "proxy"}
proxyCmd.AddCommand(start)
root.AddCommand(proxyCmd)
root.SetArgs([]string{"proxy", "start"})
require.NoError(t, root.Execute())
assert.Contains(t, got, "--transparent=true")
}