How can I get the ngx.var.* in connect? // can it get data of proxied SSL stream over CONNECT tunnel?

[p1r06u3]

How can I get the ngx.var.* in connect? For example ngx.var.uri , var.request_body and so on?

[chobits]

Hi @p1r06u3 ,

Note that CONNECT request has no URI/body information.
It's just a tunnel protocol, used to proxy raw stream(maybe SSL request).
No variable, like $reqeust_body, is supported to get raw stream data, because it is continuous data flow.

CONNECT example.host.com:22 HTTP/1.1
                   ^-------- No URI information

For the complete data flow example, see https://github.com/chobits/ngx_http_proxy_connect_module#example-for-curl

---

Some variables about CONNECT request can be accessed, for example:

• method: ngx.var.request_method
• headers of CONNECT request: for example ngx.var.http_<header_name>
• Or proxy_connect module has its own variables, see https://github.com/chobits/ngx_http_proxy_connect_module#variables

---

For CONNECT request / tunnel details, see https://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_tunneling.

[p1r06u3]

Thanks for your reply~ I am using openresty for forward proxy, but https is difficult. Then I found this connect tunnel model for https. Now I want to get the bodys . Could you give me some suggestions?

[chobits]

hi @p1r06u3

If you use this module to tunnel https stream, it cannot get https body currently.
This module do proxy stream and not modify the stream data.

But you can develop on this module to get https stream data and decode it via server ssl certificate key, then you can get the body of ssl request.

[chobits]

NOTE that this module cannot parse or modify raw tcp stream (although we know it is https stream, we dont have server's certificate/key to do something like "man-in-middle attack".).

[chobits]

think it resolved, feel free to reopen if you still have any problem

[p1r06u3]

thanks a lot. Now I write a proxy to solve my needs with goproxy lib, but it's not well at concurrency performance. I think I will optimize performance in later.

[Delitants]

Just use Charles proxy for that, MITM.

[p1r06u3]

Just use Charles proxy for that, MITM.

It cann't use Charles, because it is a single tools on computer. I need nginx or a language lib that can be developd to a proxy platform. Goproxy can support my project that has MITM model and high performence.