feat(transparent): Recover destination hostname (SNI + HTTP Host) for policy parity

Captured (iptables-REDIRECTed) traffic previously gated on the SO_ORIGINAL_DST
IP:port, while the explicit-proxy CONNECT path gates on the hostname — so
host/domain egress policy did not apply to captured bypass traffic the same way.

Add forwardproxy/sniff.go: peek the connection's first bytes (without consuming
them — replayed into the tunnel via a bufio-backed peekedConn) and recover the
destination hostname:
- HTTPS: parse the TLS ClientHello SNI, leaning on crypto/tls's own parser via a
  throwaway GetConfigForClient handshake (no hand-rolled ClientHello parsing).
- HTTP: parse the Host header from the request preamble.
Fall back to the IP when neither is recoverable. HandleTransparentConn uses the
recovered name as pctx.Host; the dial target ALWAYS stays the SO_ORIGINAL_DST IP
(never re-resolve the name). Sniffing is gated to HTTP/TLS-typical ports
(80/443/8080/8443) so non-HTTP, often server-first protocols (SSH, SMTP, ...)
are not delayed by the peek; a read deadline bounds it regardless.

Tests: real ClientHello (via crypto/tls) yields the SNI; a plaintext request
yields the Host header (port stripped); opaque bytes yield no name; all three
prove the peeked bytes are replayed verbatim. End-to-end (container) verified:
an agent dialing the IP while sending Host: api.example.test has the listener
recover api.example.test, and capture-vs-drop still holds.

Trust caveat (documented): for captured traffic the agent controls both the
name and the IP, so name-based policy is reliable against a cooperative or
misconfigured agent but is not a hard control against a hostile one — only the
IP is ground truth. The always-on operator PR must decide that threat model.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/listener/forwardproxy/sniff.go

@@ -0,0 +1,168 @@
+package forwardproxy
+
+import (
+	"bufio"
+	"bytes"
+	cryptotls "crypto/tls"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"time"
+)
+
+// Captured (iptables-REDIRECTed) connections carry no CONNECT line, so the
+// destination hostname must be recovered from the connection's own first bytes:
+// the TLS ClientHello SNI for HTTPS, or the HTTP Host header for plaintext HTTP.
+// This gives policy parity with the explicit-proxy path (which reads r.Host).
+// The recovered name is used ONLY as the policy key (pctx.Host); the dial target
+// stays the SO_ORIGINAL_DST IP. See HandleTransparentConn.
+
+const (
+	// sniffBufSize bounds how much of the leading bytes we buffer to find the
+	// SNI / Host header. Real ClientHellos and request header blocks fit well
+	// within this; anything larger falls back to the IP.
+	sniffBufSize = 8192
+	// sniffTimeout bounds the peek so a client that connects but sends nothing
+	// (or a server-first protocol) can't pin a goroutine. Only relevant on the
+	// sniffed ports, where the client speaks first, so it is rarely hit.
+	sniffTimeout = 5 * time.Second
+)
+
+// errSniffDone aborts the throwaway TLS handshake once we have the SNI.
+var errSniffDone = errors.New("forwardproxy: sni sniff complete")
+
+// shouldSniff reports whether dst's port is one where the client speaks first
+// with an HTTP/TLS preamble we can parse. Gating on these ports avoids adding
+// peek latency to non-HTTP, often server-first protocols (SSH:22, SMTP:25, ...)
+// that we would only ever blind-tunnel anyway.
+func shouldSniff(dst string) bool {
+	_, port, err := net.SplitHostPort(dst)
+	if err != nil {
+		return false
+	}
+	switch port {
+	case "80", "443", "8080", "8443":
+		return true
+	default:
+		return false
+	}
+}
+
+// sniffHost peeks the leading bytes of conn to recover the destination hostname
+// (TLS SNI or HTTP Host header) without consuming them: it returns the hostname
+// (without port; "" if none could be recovered) and a net.Conn that replays the
+// peeked bytes so the downstream tunnel still forwards the handshake/request
+// verbatim. A read deadline bounds the peek and is cleared before returning.
+func sniffHost(conn net.Conn) (string, net.Conn) {
+	br := bufio.NewReaderSize(conn, sniffBufSize)
+	wrapped := &peekedConn{Conn: conn, r: br}
+
+	_ = conn.SetReadDeadline(time.Now().Add(sniffTimeout))
+	defer func() { _ = conn.SetReadDeadline(time.Time{}) }()
+
+	first, err := br.Peek(1)
+	if err != nil || len(first) == 0 {
+		return "", wrapped
+	}
+	switch {
+	case first[0] == 0x16: // TLS handshake record
+		return stripPort(sniffTLSSNI(br)), wrapped
+	case first[0] >= 'A' && first[0] <= 'Z': // ASCII HTTP method
+		return stripPort(sniffHTTPHost(br)), wrapped
+	default:
+		return "", wrapped
+	}
+}
+
+// sniffTLSSNI peeks the first TLS record (the ClientHello) and extracts the SNI.
+func sniffTLSSNI(br *bufio.Reader) string {
+	hdr, err := br.Peek(5)
+	if err != nil || len(hdr) < 5 {
+		return ""
+	}
+	end := 5 + (int(hdr[3])<<8 | int(hdr[4]))
+	if end > br.Size() {
+		end = br.Size()
+	}
+	full, _ := br.Peek(end) // best effort: parse whatever is buffered
+	return extractSNI(full)
+}
+
+// extractSNI parses the SNI out of a buffered ClientHello by driving a throwaway
+// server-side handshake over the bytes and capturing ServerName in the config
+// callback, then aborting. Leans on crypto/tls's hardened parser rather than a
+// hand-rolled one. Returns "" if the bytes are not a parseable ClientHello.
+func extractSNI(clientHello []byte) string {
+	var sni string
+	_ = cryptotls.Server(readOnlyConn{r: bytes.NewReader(clientHello)}, &cryptotls.Config{
+		GetConfigForClient: func(chi *cryptotls.ClientHelloInfo) (*cryptotls.Config, error) {
+			sni = chi.ServerName
+			return nil, errSniffDone
+		},
+	}).Handshake()
+	return sni
+}
+
+// sniffHTTPHost peeks the request header block and returns the Host header.
+func sniffHTTPHost(br *bufio.Reader) string {
+	end := br.Buffered()
+	if end < 1 {
+		end = 1
+	}
+	for {
+		buf, err := br.Peek(end)
+		if i := bytes.Index(buf, []byte("\r\n\r\n")); i >= 0 {
+			return parseHTTPHost(buf[:i+4])
+		}
+		if err != nil || end >= br.Size() {
+			return parseHTTPHost(buf) // best effort on what we have
+		}
+		end++
+	}
+}
+
+func parseHTTPHost(headerBytes []byte) string {
+	req, err := http.ReadRequest(bufio.NewReader(bytes.NewReader(headerBytes)))
+	if err != nil {
+		return ""
+	}
+	return req.Host
+}
+
+// stripPort drops a trailing :port if present (HTTP Host headers may carry one;
+// SNI never does). The real port comes from the SO_ORIGINAL_DST destination.
+func stripPort(host string) string {
+	if host == "" {
+		return ""
+	}
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		return h
+	}
+	return host
+}
+
+// peekedConn is a net.Conn whose Read replays bytes buffered by a bufio.Reader
+// during sniffing, then continues from the underlying conn. Writes, Close,
+// deadlines, and addresses delegate to the embedded conn.
+type peekedConn struct {
+	net.Conn
+	r *bufio.Reader
+}
+
+func (c *peekedConn) Read(p []byte) (int, error) { return c.r.Read(p) }
+
+// readOnlyConn adapts a byte buffer to net.Conn for crypto/tls's server-side
+// parser. Reads come from the buffer; writes are discarded (the throwaway
+// handshake never needs to send), and the parser aborts via errSniffDone before
+// any write would matter.
+type readOnlyConn struct{ r io.Reader }
+
+func (c readOnlyConn) Read(p []byte) (int, error)       { return c.r.Read(p) }
+func (c readOnlyConn) Write(p []byte) (int, error)      { return len(p), nil }
+func (c readOnlyConn) Close() error                     { return nil }
+func (c readOnlyConn) LocalAddr() net.Addr              { return nil }
+func (c readOnlyConn) RemoteAddr() net.Addr             { return nil }
+func (c readOnlyConn) SetDeadline(time.Time) error      { return nil }
+func (c readOnlyConn) SetReadDeadline(time.Time) error  { return nil }
+func (c readOnlyConn) SetWriteDeadline(time.Time) error { return nil }

authbridge/authlib/listener/forwardproxy/sniff_test.go

@@ -0,0 +1,144 @@
+package forwardproxy
+
+import (
+	cryptotls "crypto/tls"
+	"io"
+	"net"
+	"testing"
+	"time"
+)
+
+// readAll drains a conn until EOF/close, returning what was read. Used to prove
+// the sniffer replays the peeked bytes verbatim into the tunnel.
+func readAll(t *testing.T, c net.Conn) []byte {
+	t.Helper()
+	_ = c.SetReadDeadline(time.Now().Add(2 * time.Second))
+	b, _ := io.ReadAll(c)
+	return b
+}
+
+// sniffServerSide accepts one connection on a fresh loopback listener, runs the
+// client closure against its address, and returns sniffHost's result plus the
+// bytes the wrapped conn yields (to verify replay).
+func sniffServerSide(t *testing.T, client func(addr string)) (string, []byte) {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer func() { _ = ln.Close() }()
+
+	type result struct {
+		host   string
+		replay []byte
+	}
+	ch := make(chan result, 1)
+	go func() {
+		conn, err := ln.Accept()
+		if err != nil {
+			ch <- result{}
+			return
+		}
+		host, wrapped := sniffHost(conn)
+		ch <- result{host: host, replay: readAll(t, wrapped)}
+	}()
+
+	client(ln.Addr().String())
+
+	select {
+	case r := <-ch:
+		return r.host, r.replay
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for sniff result")
+		return "", nil
+	}
+}
+
+// A real TLS ClientHello (generated by crypto/tls) with SNI must yield the SNI,
+// and the handshake bytes must still be replayed for the tunnel.
+func TestSniffHost_TLS_SNI(t *testing.T) {
+	host, replay := sniffServerSide(t, func(addr string) {
+		c, err := net.Dial("tcp", addr)
+		if err != nil {
+			t.Errorf("dial: %v", err)
+			return
+		}
+		// Drive a real ClientHello with ServerName set. The handshake won't
+		// complete (server side just sniffs and closes); we only need the
+		// ClientHello on the wire.
+		tlsConn := cryptotls.Client(c, &cryptotls.Config{
+			ServerName:         "api.openai.com",
+			InsecureSkipVerify: true, //nolint:gosec // test-only; no real verification
+		})
+		_ = tlsConn.SetDeadline(time.Now().Add(1 * time.Second))
+		_ = tlsConn.Handshake() // expected to fail; ClientHello is what matters
+		_ = c.Close()
+	})
+
+	if host != "api.openai.com" {
+		t.Errorf("SNI host = %q, want api.openai.com", host)
+	}
+	if len(replay) == 0 || replay[0] != 0x16 {
+		t.Errorf("replay did not start with a TLS record (0x16); got %d bytes", len(replay))
+	}
+}
+
+// A plaintext HTTP request must yield the Host header, port stripped, and the
+// full request must be replayed.
+func TestSniffHost_HTTP_Host(t *testing.T) {
+	req := "GET /v1/models HTTP/1.1\r\nHost: api.example.org:8080\r\nUser-Agent: x\r\n\r\n"
+	host, replay := sniffServerSide(t, func(addr string) {
+		c, err := net.Dial("tcp", addr)
+		if err != nil {
+			t.Errorf("dial: %v", err)
+			return
+		}
+		_, _ = c.Write([]byte(req))
+		_ = c.Close()
+	})
+
+	if host != "api.example.org" {
+		t.Errorf("HTTP host = %q, want api.example.org (port stripped)", host)
+	}
+	if string(replay) != req {
+		t.Errorf("replay = %q, want the original request verbatim", replay)
+	}
+}
+
+// Non-HTTP, non-TLS bytes yield no hostname but are still replayed verbatim.
+func TestSniffHost_Opaque(t *testing.T) {
+	payload := []byte{0x00, 0x01, 0x02, 0x03, 0xff}
+	host, replay := sniffServerSide(t, func(addr string) {
+		c, err := net.Dial("tcp", addr)
+		if err != nil {
+			t.Errorf("dial: %v", err)
+			return
+		}
+		_, _ = c.Write(payload)
+		_ = c.Close()
+	})
+
+	if host != "" {
+		t.Errorf("opaque host = %q, want empty", host)
+	}
+	if string(replay) != string(payload) {
+		t.Errorf("replay = %v, want %v", replay, payload)
+	}
+}
+
+func TestShouldSniff(t *testing.T) {
+	cases := map[string]bool{
+		"1.2.3.4:443":  true,
+		"1.2.3.4:80":   true,
+		"1.2.3.4:8443": true,
+		"1.2.3.4:22":   false,
+		"1.2.3.4:5432": false,
+		"[::1]:443":    true,
+		"garbage":      false,
+	}
+	for in, want := range cases {
+		if got := shouldSniff(in); got != want {
+			t.Errorf("shouldSniff(%q) = %v, want %v", in, got, want)
+		}
+	}
+}