From 0ab6867ae5facf6d54695b6e593dacb80582a5db Mon Sep 17 00:00:00 2001 From: Nuno Diegues Date: Wed, 2 Feb 2022 19:33:30 +0000 Subject: [PATCH] TUN-4947: Use http when talking to Unix sockets origins Right now the proxying of cloudflared -> unix socket is a bit of a no man's land, where we do not have the ability to specify the actual protocol since the user just configures "unix:/path/" In practice, we proxy using an HTTP client. But it could be that the origin expects HTTP or HTTPS. However, we have no way of knowing. So how are we proxying to it? We are configuring the http.Request in ways that depend on the transport and edge implementation, and it so happens that for h2mux and http2 we are using a http.Request whose Scheme is HTTP, whereas for quic we are generating a http.Request whose scheme is HTTPS. Since it does not make sense to have different behaviours depending on the transport, we are making a (hopefully temporary) change so that proxied requests to Unix sockets are systematically HTTP. In practice we should do https://github.com/cloudflare/cloudflared/issues/502 to make this configurable. --- ingress/origin_proxy.go | 1 + 1 file changed, 1 insertion(+) diff --git a/ingress/origin_proxy.go b/ingress/origin_proxy.go index ffc3d9cb..63c10137 100644 --- a/ingress/origin_proxy.go +++ b/ingress/origin_proxy.go @@ -23,6 +23,7 @@ type StreamBasedOriginProxy interface { } func (o *unixSocketPath) RoundTrip(req *http.Request) (*http.Response, error) { + req.URL.Scheme = "http" return o.transport.RoundTrip(req) }