mirror of
https://github.com/go-gost/x.git
synced 2026-10-20 08:18:33 +00:00
Mike-7777777
dc9c7444b9
The bypass was evaluated once per connection, which authorizes the first request and nothing after it. A keep-alive request naming another host re-dialed without a check, a request served from the HTTP cache needed no dial and so passed no check, a request arriving after a reload was still judged by the policy that had been in force when the connection opened, and an HTTP/2 :authority was never checked at all. With MITM enabled the same holes applied to HTTPS, since the decrypted stream is handed to the HTTP path. State the invariant instead of patching the sites one by one: every request forwarded to an upstream is authorized against the bypass in effect at the time of that request. CheckBypass is that one check, called from the four request-handling paths in the two sniffer copies. In the HTTP loop it replaces the pre-loop check rather than adding to it, so the file ends up with one check site instead of two. A reload now reaches established connections at their next request. That is a behaviour change, and it is what closes the cache and reload paths. Tunnels stay authorized at establishment: a TLS connection without MITM, a websocket after upgrade and a CONNECT tunnel have no later request to check. CheckBypass is nil-receiver safe because h2Handler can be built without handle options, and a data path should not panic over that. Measured cost against a 269-pattern bypass: 645 ns for a host that matches nothing (full wildcard scan), 149 ns for an exact hit.