verify upstream certs & reject unverified (#158)

* verify upstream certs & reject unverified

* update transport to only harden TLS & rm (http.Transport).Clone

proxy/proxy.go

@@ -96,6 +96,7 @@ func NewProxyServer(config *ProxyConfig) (ProxyServer, error) {
 
 	proxy := goproxy.NewProxyHttpServer()
 	proxy.Logger = &goproxyLoggerWrapper{}
+	proxy.Tr = newUpstreamTransport(config)
 
 	// Set verbose to true for verbose logging.
 	// Logging is handled by our own logger which has log level controls.
@@ -131,6 +132,24 @@ func NewProxyServer(config *ProxyConfig) (ProxyServer, error) {
 	return ps, nil
 }
 
+func newUpstreamTransport(config *ProxyConfig) *http.Transport {
+	dialer := &net.Dialer{
+		Timeout: config.ConnectTimeout,
+	}
+
+	// Keep transport behavior close to goproxy defaults and only harden TLS:
+	// enforce server certificate verification and require TLS 1.2+.
+	return &http.Transport{
+		Proxy:               http.ProxyFromEnvironment,
+		DialContext:         dialer.DialContext,
+		TLSHandshakeTimeout: config.ConnectTimeout,
+		TLSClientConfig: &tls.Config{
+			MinVersion:         tls.VersionTLS12,
+			InsecureSkipVerify: false,
+		},
+	}
+}
+
 func (ps *proxyServer) Start() error {
 	listener, err := net.Listen("tcp", ps.config.ListenAddr)
 	if err != nil {