Add support for event hub transport layer proxy #3051

k-shlomi · 2025-09-25T06:48:58Z

Adds SOCKS5 proxy support for Rust EventHubs client, enabling connections through corporate proxies and restricted network environments.

Changes

Core Implementation

azure_core_amqp/src/socks5.rs - New SOCKS5 connection module
- SocksConnection struct with validate_proxy_url(), connect(), mask_credentials()
- Support for socks5:// and socks5h:// protocols
- Username/password authentication via URL
- Automatic credential masking in logs
azure_core_amqp/src/connection.rs - AMQP integration
- Modified open_with_stream() to detect SOCKS5 URLs in custom_endpoint
- Zero breaking changes, backward compatible

Dependencies

tokio-socks = "0.5"
tokio-native-tls = "0.3"
native-tls = "0.2"

Documentation & Examples

azure_core_amqp/README.md - Added SOCKS5 feature documentation
eventhubs/examples/eventhubs_socks5_proxy.rs - Complete usage example
Comprehensive rustdoc with examples and troubleshooting

Usage

  let client = ProducerClient::builder()
      .with_custom_endpoint("socks5h://proxy.corp.com:1080")
      .open(host, eventhub, credential)
      .await?;

Resolves enterprise customer requirements for proxy support in restricted network environments.

github-actions · 2025-09-25T06:49:27Z

Thank you for your contribution @k-shlomi! We will review the pull request and get back to you soon.

k-shlomi · 2025-09-25T07:33:25Z

@microsoft-github-policy-service agree company="Sweet Security"

heaths

A few notes, but @LarryOsterman should definitely have a look. Thanks for the contribution!

heaths · 2025-09-25T07:52:50Z

sdk/core/azure_core_amqp/Cargo.toml

+tokio-socks = "0.5"
+tokio-native-tls = "0.3"
+native-tls = "0.2"


These should be defined as part of an optional feature for anyone to enable who wants to use the protocol. Most customers likely won't need it and the increased build time required.

@LarryOsterman we'd also want to consider whether these should be declared directly herein or in the workspace Cargo.toml. The only net new dependency is tokio-socks, but I suspect that - at least for now - AMQP is the only protocol that would support it. The others are already in the Cargo.lock file and should just be in the workspace if they even need to be declared explicitly. [email protected] already has a dependency on [email protected] and [email protected] so they probably don't need to be in here at all.

heaths · 2025-09-25T07:54:48Z

sdk/core/azure_core_amqp/src/socks5.rs

+// Copyright (c) Microsoft Corporation. All Rights reserved
+// Licensed under the MIT license.
+
+//! SOCKS5 proxy support for Azure AMQP connections


This is great module documentation, but given its not pub when imported in src/lib/rs, no one is going to see it. Necessary information might be better served in the crate README.md.

heaths · 2025-09-25T07:56:42Z

sdk/core/azure_core_amqp/README.md

+let mut options = AmqpConnectionOptions::default();
+options.custom_endpoint = Some(Url::parse("socks5h://proxy.corp.com:8080")?);


We generally prefer the construction pattern:

let options = AmqpConnectionOptions { custom_endpoint = Some("socks5h://proxy.contoso.com:8080".parse()?), ..Default::default() };

And use contoso.com or example.com.

Also means azure_core::http::Url doesn't need to be imported.

heaths · 2025-09-25T17:49:11Z

sdk/core/azure_core_amqp/src/socks5.rs

+            azure_core::Error::new(azure_core::error::ErrorKind::Other, Box::new(e)).with_context(
+                format!(
+                    "SOCKS5 connection failed: proxy={}, target={}",
+                    Self::mask_credentials(proxy_url),
+                    target_url
+                ),
+            )


Use Error::with_error:

Suggested change

azure_core::Error::new(azure_core::error::ErrorKind::Other, Box::new(e)).with_context(

format!(

"SOCKS5 connection failed: proxy={}, target={}",

Self::mask_credentials(proxy_url),

target_url

),

)

azure_core::Error::with_error(azure_core::error::ErrorKind::Other, e,

format!(

"SOCKS5 connection failed: proxy={}, target={}",

Self::mask_credentials(proxy_url),

target_url

),

)

(Something like that)

LarryOsterman · 2025-09-25T17:59:08Z

/azp run rust - eventhubs - weekly

azure-pipelines · 2025-09-25T17:59:25Z

Azure Pipelines successfully started running 1 pipeline(s).

LarryOsterman

In general, I'm singularly impressed. I have one significant concern, which is that I believe that these new tests will fail in our weekly test runs because we run our tests with --all-features and the CI pipeline doesn't have a SOCKS5 proxy available to work.

Also I'd like to have someone from the EventHubs service team take a look to confirm that they want SOCKS5 proxy support as a feature (it's complicated).

LarryOsterman · 2025-09-25T17:53:39Z

sdk/core/azure_core_amqp/src/socks5.rs

+    /// This function is automatically used in all logging statements within
+    /// the SOCKS5 implementation. Manual usage is typically not required
+    /// unless implementing custom logging or error handling.
+    pub(crate) fn mask_credentials(url: &Url) -> String {


You might want to consider using the azure_core extension method sanitize here - it implements our standardized sanitization logic. You would still need to redact the username and password since azure URLs are prohibited from using the URL username and password fields, but this adds an additional level of sanity checks on the URL.

Basically change the last line to masked.sanitize(&[])

LarryOsterman · 2025-09-25T17:55:04Z

sdk/eventhubs/azure_messaging_eventhubs/examples/eventhubs_socks5_proxy.rs

+///
+/// This function replaces username and password in the proxy URL with asterisks
+/// to prevent credential exposure in log files.
+fn mask_proxy_credentials(url: &str) -> String {


Same comment about using the sanitize() extension for the rest of the URL.

LarryOsterman · 2025-09-25T17:59:25Z

sdk/eventhubs/azure_messaging_eventhubs/tests/eventhubs_socks5_messaging.rs

+// Copyright (c) Microsoft Corporation. All Rights reserved
+// Licensed under the MIT license.
+
+#![cfg(feature = "socks5")]


Our tests are built with --all-features - how do you ensure that these tests don't fail in our live tests CI pipeline?

I think these tests should move to examples...which you already have, so if the examples are sufficient, I say we remove these integration tests if we don't have any easy way to test them on devs' machines (we don't control nor dictate how they run tests) or hosted agents.

k-shlomi · 2025-09-28T15:08:25Z

Hi @heaths and @LarryOsterman
thank you for the review.
I believe I addressed all your comments. let me know if anything else is needed.

heaths · 2025-09-29T22:16:18Z

@weshaggard @hallipr what's going on with the vcpkg install on Windows?

From the logs,

%VCPKG_BINARY_SOURCES%: error: invalid argument: binary config 'azblob' requires a SAS token without a preceeding '?' as the second argument

We're using the same setup that other repos are using, so did something break recently?

heaths · 2025-09-29T22:17:42Z

@k-shlomi please address my comments as well. See our root CONTRIBUTING.md for more information as well.

k-shlomi · 2025-09-30T13:36:59Z

@heaths I believe I did fix your comments. can you point me out to comments I missed?

weshaggard · 2025-09-30T17:25:43Z

@weshaggard @hallipr what's going on with the vcpkg install on Windows?

From the logs,

%VCPKG_BINARY_SOURCES%: error: invalid argument: binary config 'azblob' requires a SAS token without a preceeding '?' as the second argument

We're using the same setup that other repos are using, so did something break recently?

@danieljurek is investigating the vcpkg issue.

danieljurek · 2025-09-30T19:04:36Z

Notes from investigation so far:

vcpkg install shouldn't be failing here
Other pipelines are not failing because vcpkg install is invoked differently
Successful invocations in rust - pullrequest use vcpkg at version 2025-07-21-d4b65a2b83ae6c3526acd1c6f3b51aff2a884533, failing pipeline runs are showing version 2025-09-03-4580816534ed8fd9634ac83d46471440edd82dfe
There was a recent update to the image that moved vcpkg up. Looks like vcpkg is running from the image.

danieljurek · 2025-09-30T21:16:18Z

There was a breaking change to binary caching for vcpkg in this version. I have a fix working locally... PR coming soon

danieljurek · 2025-09-30T22:06:56Z

Fix is in. Rebase on main then push to re-run and get past the vcpkg install issues.

heaths

You can't take direct dependencies in a crate. There are also some sanitization concerns.

heaths · 2025-10-01T23:38:19Z

sdk/core/azure_core_amqp/Cargo.toml

+tokio-native-tls = { version = "0.3", optional = true }
 tracing.workspace = true
 typespec = { workspace = true, features = ["amqp"] }
+typespec_client_core = { workspace = true }


Everything in here is in azure_core. azure_* crates outside of core should not reference typespec crates.

@heaths I referenced it in sdk/eventhubs/azure_messaging_eventhubs/Cargo.toml in order to use the sanitize. any suggestion about that? remove sanitize? leave it in the file? what is the best course of action here?

I'm saying that the sanitization function should be exported in azure_core as well, in the same module (hopefully, unless we missed something). For any azure_* crates we're trying to "hide" the typespec crates as an implementation detail. Everything they export is imported and re-exported by azure_core in the same module path. A couple types we "override", but internally make convertible to the types they "override" in typespec.

heaths · 2025-10-01T23:39:31Z

sdk/core/azure_core_amqp/Cargo.toml

+tokio-socks = { version = "0.5", optional = true }
+native-tls = { version = "0.2", optional = true }
+tokio-native-tls = { version = "0.3", optional = true }


2 of these don't need to be referenced directly as we already have dependencies. The other has to be defined in the workspace /Cargo.toml. We don't allow direct dependencies unless @LarryOsterman thinks is worth exempting a version dependency in our appropriate place. This is to avoid version mismatches throughout the workspace - especially import as the number of crates grows.

heaths · 2025-10-01T23:40:29Z

sdk/core/azure_core_amqp/Cargo.toml

  "serde_amqp",
  "serde_bytes",
 ]
+socks5 = ["dep:tokio-socks", "dep:native-tls", "dep:tokio-native-tls"]


You also need to add this to the docs.rs metadata table below or it won't be documented. We intentionally don't document the others as they are meant more for internal testing / development.

k-shlomi · 2025-10-02T13:31:36Z

@heaths one question for you in regards to your last comments.
fixed the rest
pulled from main so now build passes

k-shlomi requested review from heaths, RickWinter, LarryOsterman and ronniegeraghty as code owners September 25, 2025 06:48

github-actions bot added Azure.Core The azure_core crate Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. labels Sep 25, 2025

heaths reviewed Sep 25, 2025

View reviewed changes

LarryOsterman requested changes Sep 25, 2025

View reviewed changes

k-shlomi force-pushed the support-eventhub-proxy branch from ed8db60 to 2ece6c7 Compare September 28, 2025 15:06

heaths requested changes Oct 1, 2025

View reviewed changes

Shlomi Kushchi added 6 commits October 2, 2025 14:46

support for eventhub proxy using tokio socks

8de95b0

lint

1e3898e

lint

267a6c7

CR fixes

60cf509

CR fixes

93c06d3

use macro to have one builder for with/without socks5

4f11853

Shlomi Kushchi added 7 commits October 2, 2025 14:46

lint

4fd6384

cr fix

7ef967a

cr fix

5c57934

cr fixes

208d56f

cr fixes

04ff4b7

cargo lock

0fd4d02

ci fixes

93fe99f

k-shlomi force-pushed the support-eventhub-proxy branch from 727fc0d to 93fe99f Compare October 2, 2025 11:46

Shlomi Kushchi added 2 commits October 2, 2025 16:04

cr fixes

260e69a

cr fixes

e72dc50

		let mut options = AmqpConnectionOptions::default();
		options.custom_endpoint = Some(Url::parse("socks5h://proxy.corp.com:8080")?);

Add support for event hub transport layer proxy #3051

Are you sure you want to change the base?

Add support for event hub transport layer proxy #3051

Conversation

k-shlomi commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Sep 25, 2025

Uh oh!

k-shlomi commented Sep 25, 2025

Uh oh!

heaths left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LarryOsterman commented Sep 25, 2025

Uh oh!

azure-pipelines bot commented Sep 25, 2025

Uh oh!

LarryOsterman left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k-shlomi commented Sep 28, 2025

Uh oh!

heaths commented Sep 29, 2025

Uh oh!

heaths commented Sep 29, 2025

Uh oh!

k-shlomi commented Sep 30, 2025

Uh oh!

weshaggard commented Sep 30, 2025

Uh oh!

danieljurek commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

danieljurek commented Sep 30, 2025

Uh oh!

danieljurek commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

heaths left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k-shlomi commented Oct 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

k-shlomi commented Sep 25, 2025 •

edited

Loading

heaths left a comment •

edited

Loading

danieljurek commented Sep 30, 2025 •

edited

Loading

danieljurek commented Sep 30, 2025 •

edited

Loading

k-shlomi commented Oct 2, 2025 •

edited

Loading