Uh oh!
There was an error while loading. Please reload this page.
Check http proxy hotfix and improvements - #449
Conversation
make all of them start with uppercase letters
dialer function was always dialing the target address/IP, it was not dialing the proxy even if it was present
…e proxy schmee is https this is due to prevent possible confusion around TLS checks in the normal usage. the TLS errors regarding the target website are ignored, certificates are only checked when --certificate mode is turned on but if the proxy is using "https" scheme, a valid TLS connection is required and checked, independently of the target website. Add logs around this, and explicitly set transport.DialTlsContext. This is separate from transport.DialContext
lgmu
commented
Aug 11, 2026
tested on windows and linux, works for my use-cases The only difference is that the monitoring-plugins check_http |
TestHTTPProxyPlain -> proxy returns immediately and increments a counter, to see if proxy is connected TestHTTPProxySSL -> target is using HTTPS, and proxy is using HTTP. Connection to proxy has nothing to check, and target using a self-signed HTTPS certificate is ignored, as in the default mode. TestHTTPProxySSLSelfSignedProxy -> target is using HTTP, and proxy is using HTTPS. TLS certificate of the proxy is verified, and it fails since it is self-signed, returnin an early CRITICAL before connecting to target.
…avior i let deepseek-v4-flash dig through the golang net code and see its supported proxy schemes
inqrphl
commented
Aug 11, 2026
-j CONNECT was a sneaky workaround to make proxying work with the older check_http. You would connect to the proxy first, and then specify the target website in the url field. To make the connection act like a proxy, you would set the HTTP method to CONNECT. Here the proxy is handled by golang http code, which automatically uses the CONNECT method when connecting to the proxy. No need to manually set it anymore. The argument is still left as -j , since it might be used for other HTTP methods if necessary, although most use cases use the GET method, which is the default. |
There was a problem hiding this comment.
Pull request overview
This PR fixes check_http proxy handling by making the custom dialer respect the addr provided by Go’s http.Transport when a proxy is configured, adds proxy-related debug logging, and introduces new proxy behavior tests plus CLI/docs text cleanups.
Changes:
- Update the dialer/transport setup so proxied connections dial the proxy address passed by
http.Transport(instead of always dialing-I/-p). - Add verbose debug logging about proxy configuration and scheme handling, including HTTPS-proxy handling logic.
- Add new proxy tests using
httptestand align option help text capitalization in code/docs.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| pkg/check_http/check_http.go | Adjusts dial/transport logic for proxy usage; adds proxy debug output and HTTPS-proxy TLS handling. |
| pkg/check_http/check_http_test.go | Adds new tests covering HTTP proxying, CONNECT-tunneling to HTTPS targets, and HTTPS-proxy certificate verification failure. |
| docs/checks/plugins/check_http.md | Updates rendered CLI option descriptions to match new/standardized help text capitalization/wording. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
| transport.DialTLSContext = func(ctx context.Context, network, addr string) (net.Conn, error) { | ||
| conn, err := dialFunc(ctx, network, addr) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return tls.Client(conn, proxyTLSConfig), nil | ||
| } |
| dialFunc := func(ctx context.Context, _ string, addr string) (net.Conn, error) { | ||
| // when a proxy is configured, the http transport passes the proxy address as addr, need to dial the proxy instead of the target | ||
| if opts.flags.Proxy != "" && addr != "" { | ||
| return baseDialFunc(ctx, tcpMode, addr) | ||
| } |
| assert.Equalf(t, CRITICAL, code, "expected exit code CRITICAL (2), got %d, output: %s", code, output.String()) | ||
| assert.Containsf(t, output.String(), "failed to verify certificate", "expected a proxy certificate verification error, output: %s", output.String()) | ||
| assert.Containsf(t, output.String(), "unknown authority", "expected an untrusted certificate error, output: %s", output.String()) |
add logging about proxy when proxyScheme is http, otherwise it would be considered unsupported in switch case Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
the problem was with the dialer function. it was unaware that the address passed to it differed if a proxy was set.
Transport.Dial takes type func(ctx context.Context, network, addr string). When a proxy is used, the address for the TCP connection is the proxy itself.
The code was always using (IP Address or Host) + Port as the target for TCP connection, since it was written with the assumption that this dialer is used after the proxy connection is established. Did not know the details about golang http package that well.
tests
add tests that spin up target and proxy http/https servers and check proxy behavior. ai generated.
TestHTTPProxyPlain -> proxy returns immediately and increments a counter, to see if proxy is connected
TestHTTPProxySSL -> target is using HTTPS, and proxy is using HTTP. Connection to proxy has nothing to check, and target using a self-signed HTTPS certificate is ignored, as in the default mode.
TestHTTPProxySSLSelfSignedProxy -> target is using HTTP, and proxy is using HTTPS. TLS certificate of the proxy is verified, and it fails since it is self-signed, returnin an early CRITICAL before connecting to target.
misc
make argument text begin with uppercase characters, it was mixed before
add debug log statements regarding proxy usage and what it will do regarding different proxy schemes