cloudflared
cloudflared copied to clipboard
Add HTTP proxy support for tunnel connections
This PR adds support for HTTP and SOCKS proxy configurations to cloudflared tunnel connections via standard environment variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY). This enables cloudflared to work in enterprise environments that require all outbound traffic to route through corporate proxy infrastructure.
Changes include:
- Added
proxyAwareDialerstruct that implements both HTTP CONNECT and SOCKS proxy protocols - Modified
rawTCPServiceandtcpOverWSServiceto useproxy.Dialerinterface instead ofnet.Dialer - Added proxy detection using
proxy.FromEnvironmentUsing()for SOCKS proxies andhttp.ProxyFromEnvironment()for HTTP proxies - There is now a
createProxyDialerto make delegation easy - DNS dialer specifically uses direct connection to avoid circular dependencies when resolving proxy hostnames
- Added tests
Proxy precedence order:
- SOCKS proxy detection via
ALL_PROXYenvironment variable - HTTP proxy detection via
HTTP_PROXY/HTTPS_PROXYenvironment variables (supports both upper and lower case)
- Direct connection fallback when no proxy is configured
Authentication support:
- Basic authentication via URL format (
http://user:pass@proxy:8080) - Proxy-Authorization headers for HTTP CONNECT method
- SOCKS4/SOCKS5 proxy support via
golang.org/x/net/proxy
Usage Example:
export HTTP_PROXY="http://user:[email protected]:8080"
export HTTPS_PROXY="http://user:[email protected]:8080"
# Or SOCKS proxy
export ALL_PROXY="socks5://proxy.corp.com:1080"
./cloudflared tunnel run --credentials-file tunnel.json my-tunnel
Example:
https://github.com/cloudflare/cloudflared/issues/1076