Golang实现本地代理并注入Proxy-Authorization头转发至远程代理

要实现一个能够正确处理CONNECT请求的代理服务器，需要区分普通HTTP请求和HTTPS隧道请求。以下是完整的解决方案：

package main

import (
    "bufio"
    "bytes"
    "context"
    "crypto/tls"
    "encoding/base64"
    "fmt"
    "io"
    "log"
    "net"
    "net/http"
    "net/http/httputil"
    "net/url"
    "strings"
    "time"
)

type ProxyConfig struct {
    IP       string
    Port     int
    Username string
    Password string
}

type ProxyServer struct {
    config     *ProxyConfig
    httpClient *http.Client
}

func NewProxyServer(config *ProxyConfig) *ProxyServer {
    // 创建支持代理的HTTP客户端
    proxyURL := fmt.Sprintf("http://%s:%d", config.IP, config.Port)
    proxy, _ := url.Parse(proxyURL)
    
    transport := &http.Transport{
        Proxy: http.ProxyURL(proxy),
        TLSClientConfig: &tls.Config{
            InsecureSkipVerify: true,
        },
        DialContext: (&net.Dialer{
            Timeout:   30 * time.Second,
            KeepAlive: 30 * time.Second,
        }).DialContext,
        MaxIdleConns:          100,
        IdleConnTimeout:       90 * time.Second,
        TLSHandshakeTimeout:   10 * time.Second,
        ExpectContinueTimeout: 1 * time.Second,
    }
    
    // 设置代理认证
    if config.Username != "" && config.Password != "" {
        auth := config.Username + ":" + config.Password
        basicAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte(auth))
        transport.ProxyConnectHeader = http.Header{
            "Proxy-Authorization": []string{basicAuth},
        }
    }
    
    return &ProxyServer{
        config: config,
        httpClient: &http.Client{
            Transport: transport,
            Timeout:   30 * time.Second,
        },
    }
}

func (p *ProxyServer) handleHTTP(w http.ResponseWriter, r *http.Request) {
    // 移除代理相关的头部
    r.RequestURI = ""
    r.URL.Scheme = "http"
    if r.URL.Host == "" {
        r.URL.Host = r.Host
    }
    
    // 复制请求体
    var bodyBytes []byte
    if r.Body != nil {
        bodyBytes, _ = io.ReadAll(r.Body)
        r.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
    }
    
    // 发送请求
    resp, err := p.httpClient.Do(r)
    if err != nil {
        http.Error(w, err.Error(), http.StatusBadGateway)
        return
    }
    defer resp.Body.Close()
    
    // 复制响应头
    for key, values := range resp.Header {
        for _, value := range values {
            w.Header().Add(key, value)
        }
    }
    w.WriteHeader(resp.StatusCode)
    
    // 复制响应体
    io.Copy(w, resp.Body)
}

func (p *ProxyServer) handleTunnel(w http.ResponseWriter, r *http.Request) {
    // 获取目标地址
    host := r.URL.Host
    if !strings.Contains(host, ":") {
        host = host + ":443"
    }
    
    // 连接到远程代理
    proxyConn, err := net.Dial("tcp", fmt.Sprintf("%s:%d", p.config.IP, p.config.Port))
    if err != nil {
        http.Error(w, err.Error(), http.StatusServiceUnavailable)
        return
    }
    defer proxyConn.Close()
    
    // 发送CONNECT请求到远程代理
    connectReq := fmt.Sprintf("CONNECT %s HTTP/1.1\r\n", host)
    connectReq += fmt.Sprintf("Host: %s\r\n", host)
    
    // 添加代理认证
    if p.config.Username != "" && p.config.Password != "" {
        auth := p.config.Username + ":" + p.config.Password
        basicAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte(auth))
        connectReq += fmt.Sprintf("Proxy-Authorization: %s\r\n", basicAuth)
    }
    
    connectReq += "\r\n"
    
    _, err = proxyConn.Write([]byte(connectReq))
    if err != nil {
        http.Error(w, err.Error(), http.StatusBadGateway)
        return
    }
    
    // 读取代理响应
    reader := bufio.NewReader(proxyConn)
    resp, err := http.ReadResponse(reader, r)
    if err != nil {
        http.Error(w, err.Error(), http.StatusBadGateway)
        return
    }
    defer resp.Body.Close()
    
    if resp.StatusCode != 200 {
        http.Error(w, "Proxy connection failed", resp.StatusCode)
        return
    }
    
    // 劫持客户端连接
    hijacker, ok := w.(http.Hijacker)
    if !ok {
        http.Error(w, "Hijacking not supported", http.StatusInternalServerError)
        return
    }
    
    clientConn, _, err := hijacker.Hijack()
    if err != nil {
        http.Error(w, err.Error(), http.StatusServiceUnavailable)
        return
    }
    defer clientConn.Close()
    
    // 发送成功响应给客户端
    clientConn.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
    
    // 双向转发数据
    go func() {
        io.Copy(proxyConn, clientConn)
        proxyConn.Close()
    }()
    io.Copy(clientConn, proxyConn)
}

func (p *ProxyServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    log.Printf("Received %s request for %s", r.Method, r.URL.String())
    
    if r.Method == "CONNECT" {
        p.handleTunnel(w, r)
    } else {
        p.handleHTTP(w, r)
    }
}

func StartProxyServer(localPort int, config *ProxyConfig) error {
    proxy := NewProxyServer(config)
    server := &http.Server{
        Addr:    fmt.Sprintf(":%d", localPort),
        Handler: proxy,
    }
    
    log.Printf("Starting proxy server on :%d", localPort)
    return server.ListenAndServe()
}

// 使用示例
func main() {
    config := &ProxyConfig{
        IP:       "51.178.42.90",
        Port:     3128,
        Username: "igopher",
        Password: "password",
    }
    
    if err := StartProxyServer(8880, config); err != nil {
        log.Fatal(err)
    }
}

对于更简单的实现，可以使用goproxy库：

package main

import (
    "crypto/tls"
    "encoding/base64"
    "fmt"
    "log"
    "net/http"
    "net/url"
    
    "github.com/elazarl/goproxy"
)

func StartGoproxyServer(localPort int, proxyIP string, proxyPort int, username, password string) {
    proxy := goproxy.NewProxyHttpServer()
    proxy.Verbose = true
    
    // 设置上游代理
    proxyURL := fmt.Sprintf("http://%s:%d", proxyIP, proxyPort)
    proxyURLParsed, _ := url.Parse(proxyURL)
    
    // 创建带认证的传输层
    transport := &http.Transport{
        Proxy: http.ProxyURL(proxyURLParsed),
        TLSClientConfig: &tls.Config{
            InsecureSkipVerify: true,
        },
    }
    
    // 设置代理认证头部
    if username != "" && password != "" {
        auth := username + ":" + password
        basicAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte(auth))
        transport.ProxyConnectHeader = http.Header{
            "Proxy-Authorization": []string{basicAuth},
        }
    }
    
    proxy.Tr = transport
    
    log.Printf("Starting goproxy server on :%d", localPort)
    log.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", localPort), proxy))
}

func main() {
    StartGoproxyServer(8880, "51.178.42.90", 3128, "igopher", "password")
}

在Selenium中使用这个本地代理：

package main

import (
    "fmt"
    "time"
    
    "github.com/tebeka/selenium"
)

func main() {
    // 启动本地代理服务器
    go StartProxyServer(8880, &ProxyConfig{
        IP:       "51.178.42.90",
        Port:     3128,
        Username: "igopher",
        Password: "password",
    })
    
    time.Sleep(2 * time.Second) // 等待代理服务器启动
    
    // 配置Selenium使用本地代理
    caps := selenium.Capabilities{
        "browserName": "chrome",
    }
    
    proxy := selenium.Proxy{
        Type: selenium.Manual,
        HTTP: "localhost:8880",
        SSL:  "localhost:8880",
    }
    caps.AddProxy(proxy)
    
    // 创建WebDriver实例
    wd, err := selenium.NewRemote(caps, "")
    if err != nil {
        panic(err)
    }
    defer wd.Quit()
    
    // 使用WebDriver
    wd.Get("https://example.com")
}

这个实现正确处理了CONNECT请求（用于HTTPS隧道）和普通HTTP请求，并自动添加Proxy-Authorization头部到上游代理。