ginuerzh dd65d46926 fix(handler/http): sync Gost-Target override into req.URL.Host to prevent policy bypass ...

A valid Gost-Target / X-Gost-Target header replaced only req.Host while
leaving req.URL.Host untouched. Destination-policy checks (bypass) evaluated
the header-derived authority, but http.Transport dialed the unchanged
absolute-URL authority. A client could label a forbidden URL with an allowed
authority and reach the blocked destination (403 -> 200 with backend body).

setRequestHost now applies the decoded target to both req.Host and req.URL.Host
so policy evaluation and transport dialing always resolve to the same authority.

2026-08-27 20:16:22 +08:00

..

auth_test.go

test(handler/http): add 25+ tests for probe resistance, MITM, bypass, and edge cases

2026-05-30 17:54:27 +08:00

auth.go

refactor(handler/http): extract Authenticator, SnifferBuilder, and normalizeRequest as testable units

2026-05-29 00:14:44 +08:00

connect_test.go

test(handler/http): add 25+ tests for probe resistance, MITM, bypass, and edge cases

2026-05-30 17:54:27 +08:00

connect.go

refactor(sniffing): register protocol handlers via init() registries

2026-08-25 21:35:45 +08:00

handler_test.go

test(handler/http): add 25+ tests for probe resistance, MITM, bypass, and edge cases

2026-05-30 17:54:27 +08:00

handler.go

x: add generic cache component and HTTP response caching

2026-07-26 17:26:00 +08:00

helpers_test.go

test(handler/http): add 25+ tests for probe resistance, MITM, bypass, and edge cases

2026-05-30 17:54:27 +08:00

metadata_test.go

test(handler/http): add 25+ tests for probe resistance, MITM, bypass, and edge cases

2026-05-30 17:54:27 +08:00

metadata.go

fix(handler/forward): split readTimeout from pipe idleTimeout to prevent 15s download abort

2026-05-31 17:05:21 +08:00

proxy_test.go

fix(handler/http): sync Gost-Target override into req.URL.Host to prevent policy bypass

2026-08-27 20:16:22 +08:00

proxy.go

fix(handler/http): resolve origin-form requests via Host header (#679)

2026-08-27 00:02:13 +08:00

udp_test.go

refactor(handler/http): extract Authenticator, SnifferBuilder, and normalizeRequest as testable units

2026-05-29 00:14:44 +08:00

udp.go

fix(handler): wrap raw *net.UDPConn with resolvePacketConn to prevent DNS leak on relay exit

2026-06-30 12:29:37 +08:00

util_test.go

fix(handler/http): sync Gost-Target override into req.URL.Host to prevent policy bypass

2026-08-27 20:16:22 +08:00

util.go

fix(handler/http): sync Gost-Target override into req.URL.Host to prevent policy bypass

2026-08-27 20:16:22 +08:00

websocket_test.go

test(handler/http): add 25+ tests for probe resistance, MITM, bypass, and edge cases

2026-05-30 17:54:27 +08:00

websocket.go

x: add Gost-Record header for client-controlled recording level

2026-07-17 15:39:07 +08:00