TLS connect proxy WIP

Author: sjorsdonkers

src/http/client.zig

@@ -657,18 +657,28 @@ pub const Request = struct {
 
             const is_connect_proxy = self._client.isConnectProxy();
             if (is_connect_proxy) {
-                try SyncHandler.connect(self);
-            }
-
-            if (self._secure) {
-                self._connection.?.tls = .{
-                    .blocking = try tls.client(std.net.Stream{ .handle = socket }, .{
-                        .host = if (is_connect_proxy) self._request_host else self._connect_host,
-                        .root_ca = self._client.root_ca,
-                        .insecure_skip_verify = self._tls_verify_host == false,
-                        // .key_log_callback = tls.config.key_log.callback,
-                    }),
-                };
+                const connect_connection = try SyncHandler.connect(self);
+                if (self._secure) {
+                    self._connection.?.tls = .{
+                        .blocking = try tls.client(connect_connection.stream, .{
+                            .host = if (is_connect_proxy) self._request_host else self._connect_host,
+                            .root_ca = self._client.root_ca,
+                            .insecure_skip_verify = self._tls_verify_host == false,
+                            // .key_log_callback = tls.config.key_log.callback,
+                        }),
+                    };
+                }
+            } else {
+                if (self._secure) {
+                    self._connection.?.tls = .{
+                        .blocking = try tls.client(std.net.Stream{ .handle = socket }, .{
+                            .host = if (is_connect_proxy) self._request_host else self._connect_host,
+                            .root_ca = self._client.root_ca,
+                            .insecure_skip_verify = self._tls_verify_host == false,
+                            // .key_log_callback = tls.config.key_log.callback,
+                        }),
+                    };
+                }
             }
 
             self._connection_from_keepalive = false;
@@ -1804,11 +1814,18 @@ const SyncHandler = struct {
 
     // Unfortunately, this is called from the Request doSendSync since we need
     // to do this before setting up our TLS connection.
-    fn connect(request: *Request) !void {
+    fn connect(request: *Request) !tls.Connection(std.net.Stream) {
         const socket = request._connection.?.socket;
 
         const header = try request.buildConnectHeader();
-        try Conn.writeAll(socket, header);
+        // try Conn.writeAll(socket, header);
+        var tls_client = try tls.client(std.net.Stream{ .handle = socket }, .{
+            .host = request._connect_host,
+            .root_ca = request._client.root_ca,
+            .insecure_skip_verify = request._tls_verify_host == false,
+            .key_log_callback = tls.config.key_log.callback,
+        });
+        try tls_client.writeAll(header);
 
         var pos: usize = 0;
         var reader = request.newReader();
@@ -1819,18 +1836,24 @@ const SyncHandler = struct {
             // we only send CONNECT requests on newly established connections
             // and maybeRetryOrErr is only for connections that might have been
             // closed while being kept-alive
-            const n = try posix.read(socket, read_buf[pos..]);
+            // const n = try posix.read(socket, read_buf[pos..]);
+            // const n = switch (self.*) {
+            //     .tls => |tls_client| try tls_client.read(buf),
+            //     .plain => |socket| try posix.read(socket, buf),
+            // };
+            const n = try tls_client.read(read_buf[pos..]);
             if (n == 0) {
                 return error.ConnectionResetByPeer;
             }
             pos += n;
             if (try reader.connectResponse(read_buf[0..pos])) {
                 // returns true if we have a successful connect response
-                return;
+                return tls_client;
             }
 
             // we don't have enough data yet.
         }
+        return tls_client;
     }
 
     fn maybeRetryOrErr(self: *SyncHandler, err: anyerror) !Response {
@@ -2081,6 +2104,7 @@ const Reader = struct {
         if (result.done == false) {
             // CONNECT responses should not have a body. If the header is
             // done, then the entire response should be done.
+            log.err(.http_client, "InvalidConnectResponse", .{ .unprocessed = result.unprocessed.? });
             return error.InvalidConnectResponse;
         }