net/http: add Transport.OnProxyConnectResponse for debugging

Author: bradfitz

api/go1.tailscale.txt

@@ -1 +1,2 @@
 pkg net/http, type Transport struct, GetProxyConnectHeader func(context.Context, *url.URL, string) (Header, error)
+pkg net/http, type Transport struct, OnProxyConnectResponse func(context.Context, *url.URL, *Request, *Response) error

src/net/http/transport.go

@@ -248,6 +248,11 @@ type Transport struct {
 	// If GetProxyConnectHeader is non-nil, ProxyConnectHeader is ignored.
 	GetProxyConnectHeader func(ctx context.Context, proxyURL *url.URL, target string) (Header, error)
 
+	// OnProxyConnectResponse is called when the Transport gets an HTTP response from
+	// a proxy for a CONNECT request. It's called before the check for a 200 OK response.
+	// If it returns an error, the request fails with that error.
+	OnProxyConnectResponse func(ctx context.Context, proxyURL *url.URL, connectReq *Request, connectRes *Response) error
+
 	// MaxResponseHeaderBytes specifies a limit on how many
 	// response bytes are allowed in the server's response
 	// header.
@@ -320,6 +325,7 @@ func (t *Transport) Clone() *Transport {
 		ExpectContinueTimeout:  t.ExpectContinueTimeout,
 		ProxyConnectHeader:     t.ProxyConnectHeader.Clone(),
 		GetProxyConnectHeader:  t.GetProxyConnectHeader,
+		OnProxyConnectResponse: t.OnProxyConnectResponse,
 		MaxResponseHeaderBytes: t.MaxResponseHeaderBytes,
 		ForceAttemptHTTP2:      t.ForceAttemptHTTP2,
 		WriteBufferSize:        t.WriteBufferSize,
@@ -1692,6 +1698,11 @@ func (t *Transport) dialConn(ctx context.Context, cm connectMethod) (pconn *pers
 			conn.Close()
 			return nil, err
 		}
+		if f := t.OnProxyConnectResponse; f != nil {
+			if err := f(ctx, cm.proxyURL, connectReq, resp); err != nil {
+				return nil, err
+			}
+		}
 		if resp.StatusCode != 200 {
 			f := strings.SplitN(resp.Status, " ", 2)
 			conn.Close()

src/net/http/transport_test.go

@@ -5830,23 +5830,26 @@ func TestTransportRequestWriteRoundTrip(t *testing.T) {
 
 func TestTransportClone(t *testing.T) {
 	tr := &Transport{
-		Proxy:                  func(*Request) (*url.URL, error) { panic("") },
-		DialContext:            func(ctx context.Context, network, addr string) (net.Conn, error) { panic("") },
-		Dial:                   func(network, addr string) (net.Conn, error) { panic("") },
-		DialTLS:                func(network, addr string) (net.Conn, error) { panic("") },
-		DialTLSContext:         func(ctx context.Context, network, addr string) (net.Conn, error) { panic("") },
-		TLSClientConfig:        new(tls.Config),
-		TLSHandshakeTimeout:    time.Second,
-		DisableKeepAlives:      true,
-		DisableCompression:     true,
-		MaxIdleConns:           1,
-		MaxIdleConnsPerHost:    1,
-		MaxConnsPerHost:        1,
-		IdleConnTimeout:        time.Second,
-		ResponseHeaderTimeout:  time.Second,
-		ExpectContinueTimeout:  time.Second,
-		ProxyConnectHeader:     Header{},
-		GetProxyConnectHeader:  func(context.Context, *url.URL, string) (Header, error) { return nil, nil },
+		Proxy:                 func(*Request) (*url.URL, error) { panic("") },
+		DialContext:           func(ctx context.Context, network, addr string) (net.Conn, error) { panic("") },
+		Dial:                  func(network, addr string) (net.Conn, error) { panic("") },
+		DialTLS:               func(network, addr string) (net.Conn, error) { panic("") },
+		DialTLSContext:        func(ctx context.Context, network, addr string) (net.Conn, error) { panic("") },
+		TLSClientConfig:       new(tls.Config),
+		TLSHandshakeTimeout:   time.Second,
+		DisableKeepAlives:     true,
+		DisableCompression:    true,
+		MaxIdleConns:          1,
+		MaxIdleConnsPerHost:   1,
+		MaxConnsPerHost:       1,
+		IdleConnTimeout:       time.Second,
+		ResponseHeaderTimeout: time.Second,
+		ExpectContinueTimeout: time.Second,
+		ProxyConnectHeader:    Header{},
+		GetProxyConnectHeader: func(context.Context, *url.URL, string) (Header, error) { return nil, nil },
+		OnProxyConnectResponse: func(ctx context.Context, proxyURL *url.URL, connectReq *Request, connectRes *Response) error {
+			return nil
+		},
 		MaxResponseHeaderBytes: 1,
 		ForceAttemptHTTP2:      true,
 		TLSNextProto: map[string]func(authority string, c *tls.Conn) RoundTripper{