GeezerVison

Adds support for the standard environment variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY.

SRC_PROXY still takes precedence, including over NO_PROXY.

Test plan

Added CI tests validating proxy connection behavior.

Manual testing

Install mitmproxy, socat and squid (brew install mitmproxy socat squid for me).

Create an SSL cert for squid:

openssl req -x509 -newkey rsa:2048 \
  -keyout ${HOME}/squid-key.pem -out ${HOME}/squid-cert.pem \
  -days 365 -nodes -subj "/CN=localhost"
cat ${HOME}/squid-key.pem ${HOME}/squid-cert.pem > ${HOME}/squid-proxy.pem

Create a config for squid:

cat << EOF >${HOME}/squid.conf
https_port 8445 cert=${HOME}/squid-proxy.pem
sslproxy_session_cache_size 0
acl localnet src 127.0.0.1/32
http_access allow localhost
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
acl Safe_ports port 1025-65535
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all
http_port 3128
EOF

Launch three terminals to run the proxies:

• run socat -d -d unix-listen:${HOME}/src-proxy.sock,fork tcp:localhost:8080 in one.
• run mitmproxy -v in another.
• run squid - squid -f ${HOME}/squid.conf -N -d 1 - in the third.

In a fourth terminal, in the src-cli repo, build the binary: go build -o ./src-cli ./cmd/src

Ensure you have SRC_ENDPOINT and SRC_ACCESS_TOKEN set in your environment, and unset SRC_PROXY. SRC_ENDPOINT needs to be https://.

Connect with each proxy (mitmproxy is 8080, squid is 8445) and with no proxy:

for x in http://localhost:8080 http://localhost:3128 https://localhost:8445
do
HTTPS_PROXY=${x} ./src-cli login --insecure-skip-verify=true
SRC_PROXY=${x} ./src-cli login --insecure-skip-verify=true
HTTPS_PROXY=${x} NO_PROXY=${${SRC_ENDPOINT#*://}%%/*} ./src-cli login --insecure-skip-verify=true
SRC_PROXY=${x} NO_PROXY=${${SRC_ENDPOINT#*://}%%/*} ./src-cli login --insecure-skip-verify=true
done
HTTPS_PROXY="" SRC_PROXY="" ./src-cli login --insecure-skip-verify=true
SRC_PROXY=${HOME}/src-proxy.sock ./src-cli login --insecure-skip-verify=true

You should get 14 "Authenticated as [USER] on [ENDPOINT]" messages in your terminal. You should see four connections in mitmproxy, six in squid, and several lines in socat indicating one connection.

This test ensures:

• all of the proxy environment variables are supported (SRC_PROXY, HTTPS_PROXY, NO_PROXY)
• NO_PROXY trumps HTTPS_PROXY
• SRC_PROXY trumps HTTPS_PROXY and NO_PROXY
• both plain HTTP and TLS-enabled proxies are supported
• the ability to connect to UNIX Domain Sockets is preserved
• communication with no proxy at all is successful

Cleanup from the test:

• terminate all running proxy processes.
• rm -f ${HOME}/squid-proxy.pem ${HOME}/squid-key.pem ${HOME}/squid-cert.pem ${HOME}/squid.conf ${HOME}/src-proxy.sock

Closes https://linear.app/sourcegraph/issue/CPL-236/src-cli-support-standard-http-proxy