Fix HTTPS inspection on Linux - replace HTTP server with manual request handling

- Replace singleConnListener approach with manual HTTP request reading
- Use http.ReadRequest to parse HTTP/1.x requests from TLS connection
- Add comprehensive debug logging for troubleshooting
- Fix connection handling to properly process and respond to HTTPS requests
- Resolves silent connection drops on Linux systems

Tested and working: TLS termination, HTTPS decryption, rule evaluation, blocking

Co-authored-by: f0ssel <[email protected]>

Author: blink-so[bot]

proxy/proxy.go

@@ -1,13 +1,15 @@
 package proxy
 
 import (
+	"bufio"
 	"context"
 	"crypto/tls"
 	"fmt"
 	"io"
 	"log/slog"
 	"net"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"time"
 
@@ -361,40 +363,68 @@ func (p *Server) handleConnect(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Perform TLS handshake with the client using our certificates
+	p.logger.Debug("Starting TLS handshake", "hostname", hostname)
 	tlsConn := tls.Server(conn, p.tlsConfig)
 	err = tlsConn.Handshake()
 	if err != nil {
 		p.logger.Error("TLS handshake failed", "hostname", hostname, "error", err)
 		return
 	}
+	p.logger.Debug("TLS handshake successful", "hostname", hostname)
 
 	// Now we have a TLS connection - handle HTTPS requests
+	p.logger.Debug("Starting HTTPS request handling", "hostname", hostname)
 	p.handleTLSConnection(tlsConn, hostname)
+	p.logger.Debug("HTTPS request handling completed", "hostname", hostname)
 }
 
 // handleTLSConnection processes decrypted HTTPS requests over the TLS connection
 func (p *Server) handleTLSConnection(tlsConn *tls.Conn, hostname string) {
-	// Create an HTTP server to handle requests over the TLS connection
-	server := &http.Server{
-		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// Set the hostname if not already set
-			if r.URL.Host == "" {
-				r.URL.Host = hostname
+	p.logger.Debug("Creating HTTP server for TLS connection", "hostname", hostname)
+	
+	// Use ReadRequest to manually read HTTP requests from the TLS connection
+	bufReader := bufio.NewReader(tlsConn)
+	for {
+		// Read HTTP request from TLS connection
+		req, err := http.ReadRequest(bufReader)
+		if err != nil {
+			if err == io.EOF {
+				p.logger.Debug("TLS connection closed by client", "hostname", hostname)
+			} else {
+				p.logger.Debug("Failed to read HTTP request", "hostname", hostname, "error", err)
 			}
-			if r.URL.Scheme == "" {
-				r.URL.Scheme = "https"
-			}
-
-			// Process this as an HTTPS request
-			p.handleDecryptedHTTPS(w, r)
-		}),
-	}
+			break
+		}
+		
+		p.logger.Debug("Processing decrypted HTTPS request", "hostname", hostname, "method", req.Method, "path", req.URL.Path)
+		
+		// Set the hostname and scheme if not already set
+		if req.URL.Host == "" {
+			req.URL.Host = hostname
+		}
+		if req.URL.Scheme == "" {
+			req.URL.Scheme = "https"
+		}
 
-	// Serve HTTP over the TLS connection
-	err := server.Serve(&singleConnListener{conn: tlsConn})
-	if err != nil && err != io.EOF {
-		p.logger.Debug("TLS connection closed", "hostname", hostname, "error", err)
+		// Create a response recorder to capture the response
+		recorder := httptest.NewRecorder()
+		
+		// Process the HTTPS request
+		p.handleDecryptedHTTPS(recorder, req)
+		
+		// Write the response back to the TLS connection
+		resp := recorder.Result()
+		err = resp.Write(tlsConn)
+		if err != nil {
+			p.logger.Debug("Failed to write response", "hostname", hostname, "error", err)
+			break
+		}
+		
+		// Close connection after single request (HTTP/1.0 style)
+		break
 	}
+	
+	p.logger.Debug("TLS connection handling completed", "hostname", hostname)
 }
 
 // handleDecryptedHTTPS handles decrypted HTTPS requests and applies rules
@@ -417,26 +447,4 @@ func (p *Server) handleDecryptedHTTPS(w http.ResponseWriter, r *http.Request) {
 
 	// Forward the HTTPS request
 	p.forwardHTTPSRequest(w, r)
-}
-
-// singleConnListener wraps a single connection to implement net.Listener
-type singleConnListener struct {
-	conn net.Conn
-	used bool
-}
-
-func (l *singleConnListener) Accept() (net.Conn, error) {
-	if l.used {
-		return nil, io.EOF
-	}
-	l.used = true
-	return l.conn, nil
-}
-
-func (l *singleConnListener) Close() error {
-	return l.conn.Close()
-}
-
-func (l *singleConnListener) Addr() net.Addr {
-	return l.conn.LocalAddr()
 }