Eliminate per-connection 407 probe for known-auth proxies

main.go

@@ -200,8 +200,22 @@ func main() {
 
 func createServer(port int, pacurl string, auth *authChain, enableSocks bool) *http.Server {
 	pacWrapper := NewPACWrapper(PACData{Port: port})
-	proxyFinder := NewProxyFinder(pacurl, pacWrapper, enableSocks)
-	proxyHandler := NewProxyHandler(auth, getProxyFromContext, proxyFinder.blockProxy)
+	// Construction order is load-bearing: authCache must exist before
+	// onPACUpdate is captured, and blockProxy before proxyFinder is used.
+	var blockProxy func(string)
+	proxyHandler := NewProxyHandler(auth, getProxyFromContext, func(host string) {
+		if blockProxy != nil {
+			blockProxy(host)
+		}
+	})
+	onPACUpdate := func() {
+		proxyHandler.authCache.Range(func(k, _ any) bool {
+			proxyHandler.authCache.Delete(k)
+			return true
+		})
+	}
+	proxyFinder := NewProxyFinder(pacurl, pacWrapper, enableSocks, onPACUpdate)
+	blockProxy = proxyFinder.blockProxy
 	mux := http.NewServeMux()
 	pacWrapper.SetupHandlers(mux)
 

multiauth_integration_test.go

@@ -405,7 +405,7 @@ func TestConnectViaProxy_FallsThroughOn407(t *testing.T) {
 	require.NoError(t, err)
 	req.Host = "example.com:443"
 
-	conn, err := connectViaProxy(req, proxy.URL(), chain)
+	conn, err := connectViaProxy(req, proxy.URL(), chain, &sync.Map{})
 	require.NoError(t, err)
 	defer conn.Close() //nolint:errcheck //nolint:errcheck
 
@@ -433,7 +433,7 @@ func TestConnectViaProxy_RefusesBasicDowngrade(t *testing.T) {
 	require.NoError(t, err)
 	req.Host = "example.com:443"
 
-	_, err = connectViaProxy(req, proxy.URL(), chain)
+	_, err = connectViaProxy(req, proxy.URL(), chain, &sync.Map{})
 	require.Error(t, err)
 	assert.ErrorIs(t, err, errNoMatchingAuthMethod)
 }

proxy.go

@@ -26,6 +26,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"sync"
 
 	"golang.org/x/net/proxy"
 )
@@ -133,7 +134,7 @@ func isToken(s string) bool {
 
 // parseProxyAuthenticateSchemes returns the deduplicated, lower-cased
 // scheme names from a 407 response's Proxy-Authenticate header(s),
-// preserving the order in which they appeared. RFC 7235 §4.3 allows
+// preserving the order in which they appeared. RFC 9110 §11.3 allows
 // either multiple Proxy-Authenticate header fields OR a single header
 // field containing a comma-separated list of challenges (RFC 7230 list
 // extension), so we honour both. The portion after the scheme token
@@ -157,11 +158,11 @@ func parseProxyAuthenticateSchemes(header http.Header) []string {
 
 // splitChallengeNames extracts the scheme names from a single
 // Proxy-Authenticate header field value that may contain multiple
-// challenges joined by commas (RFC 7235 §4.3 + RFC 7230 §7 list
+// challenges joined by commas (RFC 9110 §11.3 + RFC 7230 §7 list
 // extension). It walks the value byte-by-byte so that commas inside
 // quoted-strings are not treated as challenge separators.
 //
-// RFC 7235's challenge grammar is:
+// RFC 9110's challenge grammar is:
 //
 //	challenge = auth-scheme [ 1*SP ( token68 /
 //	    [ ( "," / auth-param ) *( OWS "," [ OWS auth-param ] ) ] ) ]
@@ -178,7 +179,7 @@ func parseProxyAuthenticateSchemes(header http.Header) []string {
 // will cause `bar` to be misclassified as a scheme name. This is benign
 // because no real authenticator's scheme() returns `bar`, so the picker
 // silently ignores it. We accept this rather than implementing full
-// RFC 7235 grammar parsing for the tail of unparseable proxies.
+// RFC 9110 grammar parsing for the tail of unparseable proxies.
 //
 // The returned strings are the raw auth-scheme tokens; the caller
 // validates them via isToken.
@@ -220,17 +221,23 @@ func splitChallengeNames(value string) []string {
 	return names
 }
 
+type proxyAuthInfo struct {
+	// schemes are lower-cased, matching parseProxyAuthenticateSchemes output.
+	schemes []string
+}
+
 type ProxyHandler struct {
 	transport *http.Transport
 	auth      *authChain
 	block     func(string)
+	authCache *sync.Map
 }
 
 type proxyFunc func(*http.Request) (*url.URL, error)
 
 func NewProxyHandler(auth *authChain, proxy proxyFunc, block func(string)) ProxyHandler {
 	tr := &http.Transport{Proxy: proxy, TLSClientConfig: tlsClientConfig}
-	return ProxyHandler{tr, auth, block}
+	return ProxyHandler{tr, auth, block, &sync.Map{}}
 }
 
 func (ph ProxyHandler) WrapHandler(next http.Handler) http.Handler {
@@ -270,7 +277,7 @@ func (ph ProxyHandler) handleConnect(w http.ResponseWriter, req *http.Request) {
 	if proxyURL == nil {
 		server, err = connectDirect(req)
 	} else {
-		server, err = connectViaProxy(req, proxyURL, ph.auth)
+		server, err = connectViaProxy(req, proxyURL, ph.auth, ph.authCache)
 		var oe *net.OpError
 		if errors.As(err, &oe) && oe.Op == "proxyconnect" {
 			log.Printf("[%d] Temporarily blocking proxy: %q", id, proxyURL.Host)
@@ -345,7 +352,8 @@ func connectDirect(req *http.Request) (net.Conn, error) {
 	return server, err
 }
 
-func connectViaProxy(req *http.Request, proxyURL *url.URL, auth *authChain) (net.Conn, error) {
+func connectViaProxy(req *http.Request, proxyURL *url.URL, auth *authChain,
+	authCache *sync.Map) (net.Conn, error) {
 	id := req.Context().Value(contextKeyID)
 
 	// SOCKS5 short-circuit: SOCKS5 has its own authentication model
@@ -377,26 +385,78 @@ func connectViaProxy(req *http.Request, proxyURL *url.URL, auth *authChain) (net
 
 	var tr transport
 	defer tr.Close() //nolint:errcheck
-	if err := tr.dial(proxyURL); err != nil {
-		log.Printf("[%d] Error dialling proxy %s: %v", id, proxyURL.Host, err)
-		return nil, err
-	}
-	resp, err := tr.RoundTrip(req)
-	if err != nil {
-		log.Printf("[%d] Error reading CONNECT response: %v", id, err)
-		return nil, err
-	}
-	if resp.StatusCode == http.StatusProxyAuthRequired && auth != nil {
-		log.Printf("[%d] Got %q response, retrying with auth", id, resp.Status)
-		schemes := parseProxyAuthenticateSchemes(resp.Header)
-		_ = resp.Body.Close()
-		// resp is now stale; the retry helper returns a fresh one.
-		authResp, err := retryConnectWithAuth(req, proxyURL, auth, schemes, &tr)
+	activeTr := &tr // points to the transport holding the live tunnel
+
+	var resp *http.Response
+	if cached, ok := authCache.Load(proxyURL.Host); ok && auth != nil {
+		// Phase 1: cache hit — skip unauthenticated probe.
+		info := cached.(proxyAuthInfo)
+		authResp, err := retryConnectWithAuth(req, proxyURL, auth, info.schemes, &tr)
+		if err != nil {
+			return nil, err
+		}
+		if authResp.StatusCode == http.StatusProxyAuthRequired {
+			// Stale cache entry — evict and fall through to cold probe.
+			authCache.Delete(proxyURL.Host)
+			_ = authResp.Body.Close()
+			tr2 := transport{}
+			defer tr2.Close() //nolint:errcheck
+			activeTr = &tr2
+			if err := tr2.dial(proxyURL); err != nil {
+				log.Printf("[%d] Error dialling proxy %s: %v", id, proxyURL.Host, err)
+				return nil, err
+			}
+			req.Header.Del("Proxy-Authorization")
+			resp2, err := tr2.RoundTrip(req)
+			if err != nil {
+				log.Printf("[%d] Error reading CONNECT response: %v", id, err)
+				return nil, err
+			}
+			if resp2.StatusCode == http.StatusProxyAuthRequired && auth != nil {
+				log.Printf("[%d] Got %q response, retrying with auth", id, resp2.Status)
+				schemes := parseProxyAuthenticateSchemes(resp2.Header)
+				_ = resp2.Body.Close()
+				authResp2, err := retryConnectWithAuth(req, proxyURL, auth, schemes, &tr2)
+				if err != nil {
+					return nil, err
+				}
+				if authResp2.StatusCode != http.StatusProxyAuthRequired {
+					authCache.Store(proxyURL.Host, proxyAuthInfo{schemes: schemes})
+				}
+				log.Printf("[%d] Got %q response", id, authResp2.Status)
+				resp = authResp2
+			} else {
+				resp = resp2
+			}
+		} else {
+			log.Printf("[%d] Got %q response", id, authResp.Status)
+			resp = authResp
+		}
+	} else {
+		// Phase 2: cold probe — no cached entry.
+		if err := tr.dial(proxyURL); err != nil {
+			log.Printf("[%d] Error dialling proxy %s: %v", id, proxyURL.Host, err)
+			return nil, err
+		}
+		var err error
+		resp, err = tr.RoundTrip(req)
 		if err != nil {
+			log.Printf("[%d] Error reading CONNECT response: %v", id, err)
 			return nil, err
 		}
-		log.Printf("[%d] Got %q response", id, authResp.Status)
-		resp = authResp
+		if resp.StatusCode == http.StatusProxyAuthRequired && auth != nil {
+			log.Printf("[%d] Got %q response, retrying with auth", id, resp.Status)
+			schemes := parseProxyAuthenticateSchemes(resp.Header)
+			_ = resp.Body.Close()
+			authCache.Store(proxyURL.Host, proxyAuthInfo{schemes: schemes})
+			// resp is now stale; the retry helper returns a fresh one.
+			authResp, err := retryConnectWithAuth(req, proxyURL, auth, schemes, &tr)
+			if err != nil {
+				return nil, err
+			}
+			log.Printf("[%d] Got %q response", id, authResp.Status)
+			resp = authResp
+		}
 	}
 	_ = resp.Body.Close()
 	if resp.StatusCode == http.StatusProxyAuthRequired {
@@ -406,7 +466,7 @@ func connectViaProxy(req *http.Request, proxyURL *url.URL, auth *authChain) (net
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("[%d] Unexpected response status: %s", id, resp.Status)
 	}
-	return tr.hijack(), nil
+	return activeTr.hijack(), nil
 }
 
 // retryConnectWithAuth iterates the configured auth chain over a CONNECT