thuanle/claw-email
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: support http/https proxy for IMAP via HTTP CONNECT tunnel
CI / fmt (pull_request) Successful in 4m45s
Details
CI / test (pull_request) Successful in 10m47s
Details

Browse Source 
Extend IMAP_PROXY_URL to accept http:// and https:// schemes in addition
to the existing socks5:// support. HTTP CONNECT tunneling is used for
both new schemes, with TLS to the proxy for https://. Proxy auth via
user:pass@ in the URL is supported for all schemes.

Refactors dialTLSViaSOCKS5 into a generic dialTLSViaProxy dispatcher.

Fixes #9

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
thuanle
2026-04-28 10:56:57 +07:00
co-authored by Claude Opus 4.7
parent b5941e5aa1
commit f978ed44b8
2 changed files with 319 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/mail/imap_test.go
+213 -6
View File
@@ -1,10 +1,20 @@
package mail
import (
"bufio"
"context"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/tls"
"crypto/x509"
"encoding/base64"
"errors"
"fmt"
"io"
"math/big"
"net"
"net/http"
"strings"
"testing"
"time"
@@ -73,13 +83,22 @@ func TestConnectAndWatch_UsesProxyDial_WhenProxySet(t *testing.T) {
}
}
func TestDialTLSViaSOCKS5_RejectsNonSocks5Scheme(t *testing.T) {
_, err := dialTLSViaSOCKS5("imap.example.com:993", "http://proxy:8080", nil)
func TestDialTLSViaProxy_RejectsUnsupportedScheme(t *testing.T) {
_, err := dialTLSViaProxy("imap.example.com:993", "ftp://proxy:21", nil)
if err == nil || !strings.Contains(err.Error(), "unsupported proxy scheme") {
t.Fatalf("expected unsupported scheme error, got %v", err)
}
}
func TestDialTLSViaProxy_RejectsMalformedURL(t *testing.T) {
_, err := dialTLSViaProxy("imap.example.com:993", "://bad", nil)
if err == nil {
t.Fatal("expected error for malformed URL")
}
}
// --- SOCKS5 path ---
type fakeContextDialer struct{}
func (fakeContextDialer) Dial(network, address string) (net.Conn, error) {
@@ -93,7 +112,7 @@ func (fakeContextDialer) DialContext(ctx context.Context, network, address strin
return nil, errors.New("used dialcontext")
}
func TestDialTLSViaSOCKS5_UsesDialContextWithTimeout(t *testing.T) {
func TestDialTLSViaProxy_SOCKS5_UsesDialContextWithTimeout(t *testing.T) {
orig := socks5DialerFactory
t.Cleanup(func() { socks5DialerFactory = orig })
@@ -104,7 +123,7 @@ func TestDialTLSViaSOCKS5_UsesDialContextWithTimeout(t *testing.T) {
return fakeContextDialer{}, nil
}
_, err := dialTLSViaSOCKS5("imap.example.com:993", "socks5://127.0.0.1:1080", nil)
_, err := dialTLSViaProxy("imap.example.com:993", "socks5://127.0.0.1:1080", nil)
if err == nil || !strings.Contains(err.Error(), "proxy dial: used dialcontext") {
t.Fatalf("expected DialContext path, got %v", err)
}
@@ -143,7 +162,7 @@ func (d contextConnDialer) DialContext(ctx context.Context, network, address str
return d.conn, nil
}
func TestDialTLSViaSOCKS5_SetsDeadlineForTLSHandshake(t *testing.T) {
func TestDialTLSViaProxy_SOCKS5_SetsDeadlineForTLSHandshake(t *testing.T) {
orig := socks5DialerFactory
t.Cleanup(func() { socks5DialerFactory = orig })
@@ -152,7 +171,7 @@ func TestDialTLSViaSOCKS5_SetsDeadlineForTLSHandshake(t *testing.T) {
return contextConnDialer{conn: conn}, nil
}
_, err := dialTLSViaSOCKS5("imap.example.com:993", "socks5://127.0.0.1:1080", nil)
_, err := dialTLSViaProxy("imap.example.com:993", "socks5://127.0.0.1:1080", nil)
if err == nil || !strings.Contains(err.Error(), "tls handshake") {
t.Fatalf("expected tls handshake error, got %v", err)
}
@@ -160,3 +179,191 @@ func TestDialTLSViaSOCKS5_SetsDeadlineForTLSHandshake(t *testing.T) {
t.Fatal("expected TLS handshake deadline to be set")
}
}
// --- HTTP CONNECT path ---
func startFakeProxy(t *testing.T, handler func(host string) bool) (addr string, cleanup func()) {
t.Helper()
ln, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
t.Fatalf("listen: %v", err)
}
done := make(chan struct{})
go func() {
defer close(done)
for {
conn, err := ln.Accept()
if err != nil {
return
}
go func(c net.Conn) {
defer c.Close()
br := bufio.NewReader(c)
req, err := http.ReadRequest(br)
if err != nil {
return
}
if handler(req.URL.Host) {
fmt.Fprintf(c, "HTTP/1.1 200 OK\r\n\r\n")
} else {
fmt.Fprintf(c, "HTTP/1.1 403 Forbidden\r\n\r\n")
}
}(conn)
}
}()
return ln.Addr().String(), func() {
ln.Close()
<-done
}
}
func TestDialTLSViaProxy_HTTPConnect_ReachesTLSHandshake(t *testing.T) {
addr, cleanup := startFakeProxy(t, func(host string) bool { return true })
defer cleanup()
_, err := dialTLSViaProxy("imap.example.com:993", fmt.Sprintf("http://%s", addr), nil)
if err == nil || !strings.Contains(err.Error(), "tls handshake") {
t.Fatalf("expected tls handshake error (CONNECT succeeded), got %v", err)
}
}
func TestDialTLSViaProxy_HTTPConnect_RejectsOnProxyFailure(t *testing.T) {
addr, cleanup := startFakeProxy(t, func(host string) bool { return false })
defer cleanup()
_, err := dialTLSViaProxy("imap.example.com:993", fmt.Sprintf("http://%s", addr), nil)
if err == nil || !strings.Contains(err.Error(), "proxy connect failed") {
t.Fatalf("expected proxy connect failed error, got %v", err)
}
}
func TestDialTLSViaProxy_HTTPConnect_SendsProxyAuth(t *testing.T) {
var gotAuth string
ln, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
t.Fatalf("listen: %v", err)
}
go func() {
defer ln.Close()
conn, err := ln.Accept()
if err != nil {
return
}
defer conn.Close()
br := bufio.NewReader(conn)
req, err := http.ReadRequest(br)
if err != nil {
return
}
gotAuth = req.Header.Get("Proxy-Authorization")
fmt.Fprintf(conn, "HTTP/1.1 200 OK\r\n\r\n")
}()
_, _ = dialTLSViaProxy("imap.example.com:993",
fmt.Sprintf("http://testuser:testpass@%s", ln.Addr().String()), nil)
expected := "Basic " + base64.StdEncoding.EncodeToString([]byte("testuser:testpass"))
if gotAuth != expected {
t.Fatalf("expected auth %q, got %q", expected, gotAuth)
}
}
func TestDialTLSViaProxy_HTTPConnect_DialError(t *testing.T) {
origDial := dialToProxy
t.Cleanup(func() { dialToProxy = origDial })
dialToProxy = func(ctx context.Context, network, addr string) (net.Conn, error) {
return nil, errors.New("dial refused")
}
_, err := dialTLSViaProxy("imap.example.com:993", "http://127.0.0.1:1", nil)
if err == nil || !strings.Contains(err.Error(), "dial proxy") {
t.Fatalf("expected dial proxy error, got %v", err)
}
}
// --- HTTPS CONNECT path ---
func generateTestCert(t *testing.T) tls.Certificate {
t.Helper()
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil {
t.Fatalf("generate key: %v", err)
}
tmpl := &x509.Certificate{
SerialNumber: big.NewInt(1),
NotBefore: time.Now(),
NotAfter: time.Now().Add(time.Hour),
KeyUsage: x509.KeyUsageDigitalSignature,
DNSNames: []string{"127.0.0.1"},
IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
}
certDER, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
if err != nil {
t.Fatalf("create cert: %v", err)
}
cert, err := x509.ParseCertificate(certDER)
if err != nil {
t.Fatalf("parse cert: %v", err)
}
return tls.Certificate{
Certificate: [][]byte{certDER},
PrivateKey: key,
Leaf: cert,
}
}
func TestDialTLSViaProxy_HTTPSConnect_ReachesTLSHandshake(t *testing.T) {
cert := generateTestCert(t)
ln, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
t.Fatalf("listen: %v", err)
}
tlsLn := tls.NewListener(ln, &tls.Config{
Certificates: []tls.Certificate{cert},
})
done := make(chan struct{})
go func() {
defer close(done)
for {
conn, err := tlsLn.Accept()
if err != nil {
return
}
go func(c net.Conn) {
defer c.Close()
br := bufio.NewReader(c)
req, err := http.ReadRequest(br)
if err != nil {
return
}
if req.URL.Host != "" {
fmt.Fprintf(c, "HTTP/1.1 200 OK\r\n\r\n")
}
}(conn)
}
}()
defer func() {
tlsLn.Close()
<-done
}()
// Override dialToProxy to return raw TCP, but inject InsecureSkipVerify
// so the TLS handshake to proxy succeeds with the test cert.
origDial := dialToProxy
t.Cleanup(func() { dialToProxy = origDial })
origProxyTLS := proxyTLSConfigForTest
t.Cleanup(func() { proxyTLSConfigForTest = origProxyTLS })
proxyTLSConfigForTest = func(host string) *tls.Config {
return &tls.Config{ServerName: host, InsecureSkipVerify: true}
}
_, err = dialTLSViaProxy("imap.example.com:993",
fmt.Sprintf("https://%s", ln.Addr().String()), nil)
if err == nil || !strings.Contains(err.Error(), "tls handshake") {
t.Fatalf("expected tls handshake error (HTTPS CONNECT succeeded), got %v", err)
}
}