feat(rust): reach the endpoint through an HTTP CONNECT proxy - #712
Draft
wkirschenmann wants to merge 2 commits into
Draft
wkirschenmann wants to merge 2 commits into
wkirschenmann wants to merge 2 commits into
Conversation
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
wkirschenmann
marked this pull request as ready for review
August 6, 2026 11:59
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 999fb068d2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
wkirschenmann
force-pushed
the
wk/feat/rust-proxy-connector
branch
from
August 7, 2026 11:40
94a79c7 to
9429805
Compare
wkirschenmann
force-pushed
the
wk/feat/rust-proxy-connector
branch
from
August 8, 2026 14:23
9429805 to
cd27110
Compare
A ProxyConnector between the TCP connector and the TLS one. It opens an HTTP CONNECT tunnel, so TLS, mutual TLS included, is negotiated end to end with the real server and the proxy only forwards opaque bytes. The handshake itself is hyper_util's Tunnel, not one written here. The route is prepared once at construction, Proxy-Authorization value included, so a connection pays no route work when the route cannot change. The connector dials the proxy itself and hands Tunnel the connected stream, so failing to reach the proxy is classified as such by construction rather than by matching upstream error text; only the 407 hint still rests on the rendered message, and an integration test pins it. ProxyError::find_in walks a returned error's source chain, so a caller can react to a proxy failure, prompting for credentials on AuthenticationRequired, without string matching. The dial is bounded by the connector's own connect timeout and the handshake by the same configured knob, 30 seconds when none is set. No behaviour change: the default stays a direct connection, and the connector delegates straight through when proxying is off. cargo test -p armonik-transport --all-features: 50 passed, 0 failed. cargo clippy -p armonik-transport --all-features --all-targets: clean.
cargo fmt --check, which CI runs, rejects the one-line form.
wkirschenmann
force-pushed
the
wk/feat/rust-proxy-connector
branch
from
August 9, 2026 08:37
cd27110 to
a301086
Compare
|
wkirschenmann
marked this pull request as draft
August 13, 2026 18:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The proxy configuration types exist; nothing dials the proxy they describe.
Description
A
ProxyConnectorbetween the TCP connector and the TLS one. It opens an HTTPCONNECTtunnel,so TLS, mutual TLS included, is negotiated end to end with the real server and the proxy only
forwards opaque bytes. The handshake itself is
hyper_util'sTunnel, not code written here.The route is prepared once at construction,
Proxy-Authorizationvalue included. The connectordials the proxy itself and hands
Tunnelthe connected stream, so failing to reach the proxy isclassified as such by construction rather than by matching upstream error text; only the 407 hint
still rests on the rendered message, and an integration test pins that wording.
ProxyError::find_inwalks a returned error's source chain, so a caller can react toAuthenticationRequiredby prompting for credentials instead of string-matching. The dial isbounded by the connector's own connect timeout and the handshake by the same configured knob,
30 seconds when none is set.
Testing
cargo test -p armonik-transport --all-features: 50 passed, of which 8 drive a real clientthrough a real
CONNECTproxy to a real gRPC server over loopback sockets: the tunnel,credentials demanded, presented, in the URL, missing and wrong, an unreachable proxy, proxying
off, and a proxy that goes quiet. The run is in the commit message.
Impact
No behaviour change: the default stays a direct connection, and the connector delegates straight
through when proxying is off.
hyper-utilgains theclient-legacyandtokiofeatures, bothalready enabled transitively and now named;
tokio(net, time) andtower-servicebecome regulardependencies of the crate.
Additional Information
Stacks on
wk/feat/rust-proxy-types; merge that first.Checklist