Rules based on SSL certificate about go-any-proxy

[tmackay]

I can see how getting the details from the certificate would come in handy - hostname for example. What if we could connect first by IP, get the certificate details, then reconnect using hostname? This would help a lot with hostname based acls in the parent proxy.

[ryanchapman]

I like your idea tmackay--it's adds an additional layer of security. Adding it to the issue.

[skbly7]

I think we (I and @jyotishp) have a PoC implementation for this over go-any-proxy.
Any comments or suggestions would be great.

The first packet is being captured i.e. HELLO, hostname extracted out using sni.go available in google/tcpproxy. This allows us to make hostname based connection on parent proxies, so filtering rules remain intact. Further, the initial HELLO packet is retransmitted upon proxy
CONNECT. Overall, HTTPS is preserved.

master...skbly7:master

[ryanchapman]

Just taking a quick pass, looks ok to me. Could you add an optional flag so that it isn't enabled by default? Then I think we could merge a PR.

[skbly7]

Sure, I have made it optional and sent the pull request for the same.

[ryanchapman]

Thanks for the contribution!