Add upstream proxy by eraow · Pull Request #104 · coder/httpjail

eraow · 2026-07-13T13:18:20Z

Note: This PR was generated with AI assistance.

Summary

Adds an --upstream-proxy option so httpjail can forward its own outbound
requests through an HTTP proxy. This makes httpjail usable in environments
that only allow internet access via a corporate proxy.

Motivation

I want to run httpjail behind a corporate proxy. Without this option,
httpjail connects directly to upstream hosts, which fails when direct
egress is blocked and only a proxy is permitted.

What this does

Adds --upstream-proxy <URL> (e.g. http://proxy.example.com:8080).
When set, httpjail routes its upstream HTTP/HTTPS requests through the
given proxy instead of connecting directly.
Behavior is unchanged when the flag is not provided.

Usage

httpjail --upstream-proxy http://proxy.example.com:8080 --js-file rules.js -- curl https://github.com

Manual verification

$ cat rules.js
const DOMAINS = [
  "github.com",
];

(function () {
  const h = (r.host || "").toLowerCase();
  for (const d of DOMAINS) {
    if (d[0] === ".") {
      if (h === d.slice(1) || h.endsWith(d)) return true;
    } else if (h === d) {
      return true;
    }
  }
  return false;
})();


## PASS Test
$ sudo env -u SUDO_UID -u SUDO_GID target/debug/httpjail -v  --upstream-proxy http://${proxy}:8080 --js-file rules.js --request-log jail.log curl -s -o /dev/null -w "%{http_code}\n" https://github.com
22:02:58.774  INFO httpjail: Using V8 JavaScript rule evaluation from file: rules.js
22:02:58.776  INFO httpjail::rules::v8_js: File watching enabled for JS rules - will check for changes on each request
22:02:58.776  INFO httpjail::rules::v8_js: V8 JavaScript rule engine initialized
22:02:58.776  INFO httpjail: Routing httpjail upstream requests through the configured upstream proxy
22:02:58.776  INFO httpjail::tls: Loaded cached CA certificate from /root/.config/httpjail/ca-cert.pem
22:02:58.776  INFO httpjail::tls: Certificate manager initialized
22:02:58.776  INFO httpjail::proxy: Upstream client initialized to route through the upstream proxy
22:02:58.776  INFO httpjail::proxy: Starting HTTP proxy on port 33769
22:02:58.776  INFO httpjail::proxy: Starting HTTPS proxy on port 34343
22:02:58.777  INFO httpjail::jail::linux::resources: Created network namespace: httpjail_er7tzu31
22:02:58.777  INFO httpjail::jail::linux: Created network namespace: httpjail_er7tzu31
22:02:58.918  INFO httpjail::jail::linux: Routes in namespace httpjail_er7tzu31 after configuration:
default via 10.99.184.253 dev vn_er7tzu31 
10.99.184.252/30 dev vn_er7tzu31 proto kernel scope link src 10.99.184.254 

22:02:58.918  INFO httpjail::jail::linux: Creating /etc/netns resolv.conf with nameserver 10.99.184.253
22:02:58.918  INFO httpjail::jail::linux::resources: Created /etc/netns/httpjail_er7tzu31/resolv.conf with nameserver 10.99.184.253
22:02:58.918  INFO httpjail::jail::linux: Starting host DNS server on 10.99.184.253
22:02:58.918  INFO httpjail::jail::linux::dns: Starting dummy DNS server on 10.99.184.253:53
22:02:58.918  INFO httpjail::jail::linux: Started host DNS server on 10.99.184.253:53
22:02:58.923  INFO httpjail::jail::linux::nftables: Created nftables table httpjail_er7tzu31 with NAT rules for subnet 10.99.184.252/30
22:02:58.923  INFO httpjail::jail::linux: Set up NAT rules for namespace httpjail_er7tzu31 with subnet 10.99.184.252/30
22:02:58.949  INFO httpjail::jail::linux::nftables: Created nftables rules in namespace httpjail_er7tzu31 for HTTP:33769 HTTPS:34343
22:02:58.949  INFO httpjail::jail::linux: Linux jail setup complete using namespace httpjail_er7tzu31 with HTTP proxy on port 33769 and HTTPS proxy on port 34343
22:02:58.949  INFO httpjail::jail::managed: Started lifecycle heartbeat for jail 'er7tzu31'
22:02:58.961  INFO httpjail::proxy_tls: Extracted SNI hostname: github.com
22:02:58.961  INFO httpjail::tls: Certificate generation: hostname=github.com, key_type=ECDSA-P256
200
22:02:59.067  INFO httpjail::jail::linux: Triggering jail cleanup for er7tzu31

## BLOCK Test
$ sudo env -u SUDO_UID -u SUDO_GID target/debug/httpjail -v  --upstream-proxy http://${proxy}:8080 --js-file rules.js --request-log jail.log curl -s -o /dev/null -w "%{http_code}\n" https://example.com
22:03:10.078  INFO httpjail: Using V8 JavaScript rule evaluation from file: rules.js
22:03:10.080  INFO httpjail::rules::v8_js: File watching enabled for JS rules - will check for changes on each request
22:03:10.080  INFO httpjail::rules::v8_js: V8 JavaScript rule engine initialized
22:03:10.080  INFO httpjail: Routing httpjail upstream requests through the configured upstream proxy
22:03:10.080  INFO httpjail::tls: Loaded cached CA certificate from /root/.config/httpjail/ca-cert.pem
22:03:10.080  INFO httpjail::tls: Certificate manager initialized
22:03:10.080  INFO httpjail::proxy: Upstream client initialized to route through the upstream proxy
22:03:10.080  INFO httpjail::proxy: Starting HTTP proxy on port 36481
22:03:10.080  INFO httpjail::proxy: Starting HTTPS proxy on port 36955
22:03:10.082  INFO httpjail::jail::linux::resources: Created network namespace: httpjail_ri1ch208
22:03:10.082  INFO httpjail::jail::linux: Created network namespace: httpjail_ri1ch208
22:03:10.240  INFO httpjail::jail::linux: Routes in namespace httpjail_ri1ch208 after configuration:
default via 10.99.247.149 dev vn_ri1ch208 
10.99.247.148/30 dev vn_ri1ch208 proto kernel scope link src 10.99.247.150 

22:03:10.240  INFO httpjail::jail::linux: Creating /etc/netns resolv.conf with nameserver 10.99.247.149
22:03:10.240  INFO httpjail::jail::linux::resources: Created /etc/netns/httpjail_ri1ch208/resolv.conf with nameserver 10.99.247.149
22:03:10.240  INFO httpjail::jail::linux: Starting host DNS server on 10.99.247.149
22:03:10.240  INFO httpjail::jail::linux::dns: Starting dummy DNS server on 10.99.247.149:53
22:03:10.240  INFO httpjail::jail::linux: Started host DNS server on 10.99.247.149:53
22:03:10.245  INFO httpjail::jail::linux::nftables: Created nftables table httpjail_ri1ch208 with NAT rules for subnet 10.99.247.148/30
22:03:10.245  INFO httpjail::jail::linux: Set up NAT rules for namespace httpjail_ri1ch208 with subnet 10.99.247.148/30
22:03:10.273  INFO httpjail::jail::linux::nftables: Created nftables rules in namespace httpjail_ri1ch208 for HTTP:36481 HTTPS:36955
22:03:10.273  INFO httpjail::jail::linux: Linux jail setup complete using namespace httpjail_ri1ch208 with HTTP proxy on port 36481 and HTTPS proxy on port 36955
22:03:10.273  INFO httpjail::jail::managed: Started lifecycle heartbeat for jail 'ri1ch208'
22:03:10.302  INFO httpjail::proxy_tls: Extracted SNI hostname: example.com
22:03:10.302  INFO httpjail::tls: Certificate generation: hostname=example.com, key_type=ECDSA-P256
403
22:03:10.353  INFO httpjail::jail::linux: Triggering jail cleanup for ri1ch208

ammario · 2026-07-20T17:23:55Z

+By default httpjail contacts destination servers directly. When httpjail itself
+runs in an environment that has no direct internet access — for example behind a
+corporate proxy — you can route httpjail's own outbound requests through an
+upstream proxy with `--upstream-proxy` (or the `HTTPJAIL_UPSTREAM_PROXY`


Why shouldn't httpjail itself respect the standard HTTP_PROXY variables? I think it's clear on its face it wouldn't pass that down to children (as that would invalidate the whole point of the jail).

Agreed. For the first release, I’ll remove --upstream-proxy and HTTPJAIL_UPSTREAM_PROXY and use the standard HTTP_PROXY / HTTPS_PROXY environment variables for httpjail’s own egress.
Adding a dedicated CLI option and httpjail-specific env var creates an extra configuration path before we have a concrete need for it. If we later need an explicit per-invocation override, we can add it in a follow-up change.

Done in 701d116.

Remove the upstream proxy CLI option and httpjail-specific environment variable, and resolve httpjail's own upstream proxy from HTTP_PROXY and HTTPS_PROXY instead. Also keep the new upstream proxy initialization logs at debug level so normal CLI output is not affected.

eraow added 6 commits July 10, 2026 21:07

Add upstream proxy feature

4b3a9a6

fix: redact upstream proxy credentials

a28754e

fix: time out upstream proxy TCP connects

1bd3203

fix: support IPv6 upstream proxy addresses

d08e61c

refactor: use libraries for proxy credential encoding

3d11be8

refactor: parse upstream proxy URLs with url crate

7301b5a

eraow marked this pull request as ready for review July 13, 2026 14:24

ammario requested changes Jul 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add upstream proxy #104

Add upstream proxy #104
eraow wants to merge 7 commits into
coder:mainfrom
eraow:feature/upstream-proxy

eraow commented Jul 13, 2026 •

edited

Loading

Uh oh!

ammario Jul 20, 2026

Uh oh!

eraow Jul 21, 2026

Uh oh!

eraow Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

eraow commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

What this does

Usage

Manual verification

Uh oh!

ammario Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

eraow Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

eraow Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

eraow commented Jul 13, 2026 •

edited

Loading