第21章 Go：100 行手写 HTTP/CONNECT + SOCKS5 代理

// http_proxy.go —— go run http_proxy.go，监听 :8080
package main

import (
	"io"
	"log"
	"net"
	"net/http"
	"time"
)

// hop-by-hop 头：代理必须删除，不得转发（见第04章）
var hopHeaders = []string{
	"Connection", "Proxy-Connection", "Keep-Alive",
	"Proxy-Authenticate", "Proxy-Authorization",
	"Te", "Trailer", "Transfer-Encoding", "Upgrade",
}

func main() {
	server := &http.Server{
		Addr:    ":8080",
		Handler: http.HandlerFunc(handle),
	}
	log.Println("HTTP 代理已启动: 127.0.0.1:8080")
	log.Fatal(server.ListenAndServe())
}

func handle(w http.ResponseWriter, r *http.Request) {
	if r.Method == http.MethodConnect {
		handleConnect(w, r) // HTTPS 等加密流量走隧道
	} else {
		handleHTTP(w, r) // 明文 HTTP 直接转发
	}
}

// 明文 HTTP：absolute-form 的 URL 已被标准库解析进 r.URL，直接重发
func handleHTTP(w http.ResponseWriter, r *http.Request) {
	removeHopHeaders(r.Header)
	r.RequestURI = "" // RoundTrip 要求客户端请求必须清空 RequestURI

	resp, err := http.DefaultTransport.RoundTrip(r)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadGateway) // 502：到源站失败
		return
	}
	defer resp.Body.Close()

	removeHopHeaders(resp.Header)
	copyHeader(w.Header(), resp.Header)
	w.WriteHeader(resp.StatusCode)
	io.Copy(w, resp.Body)
}

// CONNECT：劫持底层 TCP，两条连接间盲转字节
func handleConnect(w http.ResponseWriter, r *http.Request) {
	dst, err := net.DialTimeout("tcp", r.Host, 10*time.Second) // r.Host = "example.com:443"
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadGateway)
		return
	}

	hij, ok := w.(http.Hijacker)
	if !ok {
		http.Error(w, "不支持 Hijack", http.StatusInternalServerError)
		dst.Close()
		return
	}
	client, _, err := hij.Hijack() // 拿回裸 net.Conn，标准库不再插手
	if err != nil {
		dst.Close()
		return
	}

	// 手动写 200 到被劫持的连接，告诉客户端"隧道已开"
	client.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))

	// 双向拷贝：任一方向结束就关闭两端
	go transfer(dst, client)
	transfer(client, dst)
}

func transfer(dst, src net.Conn) {
	defer dst.Close()
	defer src.Close()
	io.Copy(dst, src) // Linux 上 TCP→TCP 自动 splice 零拷贝
}

func removeHopHeaders(h http.Header) {
	for _, k := range hopHeaders {
		h.Del(k)
	}
}

func copyHeader(dst, src http.Header) {
	for k, vv := range src {
		for _, v := range vv {
			dst.Add(k, v)
		}
	}
}

// socks5.go —— go run socks5.go，监听 :1080
package main

import (
	"encoding/binary"
	"fmt"
	"io"
	"log"
	"net"
)

func main() {
	ln, err := net.Listen("tcp", ":1080")
	if err != nil {
		log.Fatal(err)
	}
	log.Println("SOCKS5 代理已启动: 127.0.0.1:1080")
	for {
		c, err := ln.Accept()
		if err != nil {
			continue
		}
		go handle(c)
	}
}

func handle(client net.Conn) {
	defer client.Close()

	// ── 阶段 1：方法协商 ──
	// 客户端: VER(0x05) NMETHODS METHOD...
	head := make([]byte, 2)
	if _, err := io.ReadFull(client, head); err != nil || head[0] != 0x05 {
		return
	}
	methods := make([]byte, int(head[1]))
	if _, err := io.ReadFull(client, methods); err != nil {
		return
	}
	// 服务端: VER(0x05) METHOD(0x00=无需认证)
	client.Write([]byte{0x05, 0x00})

	// ── 阶段 2：读取请求 ──
	// 客户端: VER CMD RSV ATYP DST.ADDR DST.PORT
	req := make([]byte, 4)
	if _, err := io.ReadFull(client, req); err != nil {
		return
	}
	ver, cmd, atyp := req[0], req[1], req[3]
	if ver != 0x05 || cmd != 0x01 { // 只支持 CONNECT(0x01)
		reply(client, 0x07)         // 0x07 = 命令不支持
		return
	}

	host, err := readAddr(client, atyp)
	if err != nil {
		reply(client, 0x08) // 0x08 = 地址类型不支持
		return
	}
	portBuf := make([]byte, 2)
	if _, err := io.ReadFull(client, portBuf); err != nil {
		return
	}
	target := fmt.Sprintf("%s:%d", host, binary.BigEndian.Uint16(portBuf))

	// ── 阶段 3：拨号 + 应答 + 转发 ──
	dst, err := net.Dial("tcp", target)
	if err != nil {
		reply(client, 0x05) // 0x05 = 连接被拒
		return
	}
	defer dst.Close()
	reply(client, 0x00) // 0x00 = 成功

	go io.Copy(dst, client)
	io.Copy(client, dst)
}

// 按 ATYP 读出目标地址
func readAddr(c net.Conn, atyp byte) (string, error) {
	switch atyp {
	case 0x01: // IPv4：4 字节
		b := make([]byte, 4)
		_, err := io.ReadFull(c, b)
		return net.IP(b).String(), err
	case 0x04: // IPv6：16 字节
		b := make([]byte, 16)
		_, err := io.ReadFull(c, b)
		return net.IP(b).String(), err
	case 0x03: // 域名：1 字节长度 + N 字节
		l := make([]byte, 1)
		if _, err := io.ReadFull(c, l); err != nil {
			return "", err
		}
		b := make([]byte, int(l[0]))
		_, err := io.ReadFull(c, b)
		return string(b), err
	}
	return "", fmt.Errorf("未知 ATYP: %d", atyp)
}

// 应答: VER REP RSV ATYP BND.ADDR BND.PORT（BND 全填 0 即可）
func reply(c net.Conn, rep byte) {
	c.Write([]byte{0x05, rep, 0x00, 0x01, 0, 0, 0, 0, 0, 0})
}