net/http: custom net.Conn impls break http.Request.TLS

[tamird]

Partial continuation of #12737 which made it possible to fix the problem for http2, but not http1.

As pointed out in the cmux readme's limitations section:

TLS: Since cmux sits in between the actual listener and the mux'ed listeners, TLS handshake is not handled inside the actual servers. Because of that, you can serve HTTPS using cmux but http.Request.TLS would not be set in your handlers.

This is really due to the type assertion used to identify TLS connections, which sadly breaks the goodness of net.Conn and net.Listener being interfaces.

Relevant code: https://github.com/golang/go/blob/release-branch.go1.6/src/net/http/server.go#L1398:L1410

Can this type assertion to a concrete type be replaced with an assertion to an interface?

[bradfitz]

Yes, we can do that for 1.7.

[gopherbot]

CL https://golang.org/cl/19741 mentions this issue.

[tamird]

Note that it's possible to do this with a mux today, so long as you're able to demux upstream of the tls.NewListener.

[danp]

Would asserting on a local/private interface of:

type tlsHandshaker interface {
  SetReadDeadline(time.Time)
  SetWriteDeadline(time.Time)
  Handshake() error
  ConnectionState() tls.ConnectionState
}

be sufficient for this?

[tamird]

Probably; that's just about what was done in golang/net@6ccd669#diff-2bfffed39205fa6cd0bb2601af7251a4R427

[danp]

(happy to do that if so)

[danp]

That almost works. What should be done about the TLSNextProto map that takes a literal *tls.Conn?

[danp]

The problem spot being here, where fn wants a literal *tls.Conn due to the type of TLSNextProto being map[string]func(*Server, *tls.Conn, Handler).

[bradfitz]

@dpiddy, yeah, that's the problem. Maybe we shouldn't even "fix" this.

Generally people want this so they can use https://godoc.org/github.com/spacemonkeygo/openssl or something, but that's not something I really want to encourage.

For a mux, can't you record the traffic seen at the beginning of the handshake during routing and then replay it, stitching together the captured traffic and the underlying net.Conn, feeding that into https://golang.org/pkg/crypto/tls/#Server?

@tamird, can I can get an update on the motivation for this bug?