feat(grpc): Add resolver wrapper to handle HTTP CONNECT proxy configuration by arjan-bal · Pull Request #2679 · grpc/grpc-rust

arjan-bal · 2026-06-08T12:30:45Z

This PR implements a resolver wrapper that determines proxy routing by checking the HTTPS_PROXY and NO_PROXY environment variables. By default, hyper-util matches cURL's behavior by falling back to ALL_PROXY when HTTPS_PROXY is unset. However, because Go's FromEnvironment and gRPC C++ ignore ALL_PROXY, gRPC Rust manually configures the Matcher to bypass it, ensuring cross-language consistency.

Resolution Flow
When HttpsProxyResolver::Builder builds a resolver for a target URI, it uses hyper_util::client::proxy::Matcher to evaluate the environment variables:

Direct Connection: If no proxy is required, it delegates resolution entirely to the wrapped child builder, bypassing the proxy resolver.
Proxied Connection: If a proxy is required, it creates an HttpsProxyResolver, which uses the child DNS resolver to resolve the proxy server's hostname instead of the target.
Attribute Injection: The HttpsProxyResolver intercepts resolution updates from the child resolver. It attaches the necessary proxy configuration (the original target authority and basic auth credentials) as attributes to each resolved proxy address.

In follow-up PRs, the subchannel will read these address attributes to wrap the channel credentials and carry out the HTTP CONNECT handshake prior to the standard credential handshake.

Internal design doc: go/grpc-rust-http-connect
Transport changes: #2698

arjan-bal · 2026-06-08T16:16:09Z

/gemini review

gemini-code-assist

Code Review

This pull request refactors the gRPC client to support arbitrary byte-based addresses (via ByteStr) instead of requiring valid UTF-8 strings, enabling support for non-UTF-8 unix socket paths. It also introduces an HTTP CONNECT proxy resolver that intercepts DNS resolution and applies proxy configurations based on environment variables. The review feedback suggests bypassing proxy resolution entirely for non-DNS schemes (like unix or inmemory), safely handling empty NO_PROXY environment variables, and updating tests to verify that unix paths correctly bypass the proxy.

ejona86 · 2026-06-18T21:20:59Z

+        options: ResolverOptions,
+        matcher: Option<&Matcher>,
+    ) -> Result<Box<dyn Resolver>, (String, ResolverOptions)> {
+        // Skip proxy lookup for known non-TCP schemes.


I'd expect to skip it for anything that isn't dns. I think there had been a little discussion around that, but I don't know where it ended.

The host will be passed to the proxy and the proxy then has to do the resolution, but we've discarded the scheme. It seems we are assuming dns formatting of the target string as well. We shouldn't be parsing the target string without knowledge of the specific scheme in use. Things would be better if we delegated to the name resolver to parse the target string into an authority.

Answering inline:

I'd expect to skip it for anything that isn't dns. I think there had been a little discussion around that, but I don't know where it ended.

The initial intention behind implementing proxy resolution as a separate resolver builder was to allow all custom resolvers to get HTTP CONNECT support for free. For context, the C++ implementation skips proxying for unix URLs, while in Go, target host resolution can only be skipped for dns URLs. Java simply implements the proxy logic inside the DNS resolver itself.

I've now updated the Rust implementation to skip proxying for all non-dns URLs.

Things would be better if we delegated to the name resolver to parse the target string into an authority.

I've updated the code to use the target resolver builder for authority parsing. Based on the previous point, this will inherently be a DNS resolver.

dfawley · 2026-06-30T20:38:48Z

+use super::ResolverOptions;
+use super::Target;


Nit: please try to avoid use super except in test mods.

Fixed and noted.

dfawley · 2026-06-30T20:47:43Z

+    fn build(&self, target: &Target, options: ResolverOptions) -> Box<dyn Resolver> {
+        match self.new_resolver(target, options, MATCHER.as_ref()) {
+            Ok(resolver) => resolver,
+            Err((err, options)) => NopResolver::new_with_err(err, options),


Optional: consider making new_resolver infallible and return the NopResolver itself instead. It avoids needing to pass the options back and forth.

dfawley · 2026-06-30T21:36:55Z

+}
+
+struct HttpsProxyResolver {
+    child: Box<dyn Resolver>,


Interestingly this is always a dns::DnsResolver. Should we put that type in here directly instead of a dyn?

The DNS resolver builder returns a NopResolver if the target is an IP address here:

grpc-rust/grpc/src/client/name_resolution/dns/mod.rs

Lines 212 to 217 in 829ce18

Host::Ipv4(ipv4) => {

return nop_resolver_for_ip(IpAddr::V4(ipv4), endpoint.port, options);

}

Host::Ipv6(ipv6) => {

return nop_resolver_for_ip(IpAddr::V6(ipv6), endpoint.port, options);

}

To return a single concrete type from dns::Builder, we could introduce a dns::Resolver enum with NopResolver and DnsResolver variants and expose it via a pub(crate) method.

I'm wondering if this refactoring provides any real benefit. Since HttpsProxyResolver only requires the methods already defined on the Resolver trait, staying with the trait might be cleaner. What do you think?

I'm wondering if this refactoring provides any real benefit.

No, I think this is fine. If this was always one type I think it would make sense to just name it and have it there, but since it's more, then this way is better.

dfawley · 2026-06-30T21:47:59Z

+    /// Returns the address of the proxy server to connect to (host:port).
+    /// This is Punycode-encoded, i.e., it's a valid URL host:port.
+    pub(crate) fn target_authority(&self) -> &str {
+        &self.connect_addr


Would it be better if the names matches?

Renamed both, the field and the getter to connect_authority.

dfawley · 2026-06-30T21:49:22Z

+        if let Ok(endpoints) = &mut update.endpoints {
+            for endpoint in endpoints {
+                for address in &mut endpoint.addresses {
+                    address.attributes = address.attributes.add(self.proxy_options.clone());


I think the attribute should be somewhere more central, like in grpc/client/transport maybe?

Moved the ProxyOptions and its helpers into the transport module.

dfawley · 2026-07-01T20:42:03Z

    pub(crate) handshake_info: ClientHandshakeInfo,
 }
+
+/// Options for establishing an HTTP CONNECT proxy tunnel.


Maybe mention that this can be added to addresses' attributes, and transports that support it will read it from there and use the address as a CONNECT proxy instead of a backend.

What about transports that don't support it, though? Should those error? (It seems like they should...) We can deal with this later, but something to think about. Maybe we should have a separate address type for a proxy address or something.

Based on the latest revision of the design, the subchannel will wrap the channel credentials in an HTTP CONNECT handshaker, making it transparent to transports. I've added this information in the rustdoc.

dfawley · 2026-07-01T20:42:27Z

+    ///   Must be a valid hostname.
+    /// * `proxy_authorization_header` - The value of the `Proxy-Authorization` header, if present.
+    pub(crate) fn new(
+        target_authority: String,


connect_authority?

I'm not sure what the best name to use for this is (consider also target_address or backend_address maybe?), but it should match between field, constructor, and accessor.

Changed to target_authority throughout.

arjan-bal added 10 commits June 5, 2026 00:21

allow non-utf8 addresses in Address struct

054f074

precent decode path in target URL

dea8d57

polish

4cb1693

fix non-unix build

991204a

fix darwin test

060c345

Merge remote-tracking branch 'source/master' into non-utf-strings

39c081d

add proxy resolver

6ce704c

add minor version to dep

0ffbba6

Merge remote-tracking branch 'source/master' into non-utf-strings

3194351

Add minor version in dep

b6a4bcd

gemini-code-assist Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread grpc/src/client/name_resolution/proxy_resolver.rs

Comment thread grpc/src/client/name_resolution/proxy_resolver.rs

Comment thread grpc/src/client/name_resolution/proxy_resolver.rs

arjan-bal added 10 commits June 8, 2026 23:04

skip proxy for unix schemes

e502faf

Move authority parsing constructor

2164fc4

fix handling of unbrackated IPv6 in target address

5f7c97d

disallow non-UTF-8 symbols in path

5cc591e

Merge branch 'non-utf-strings' into http-proxy-resolver

52dfb74

fix merge

9d2964b

disable unecessary feature

9306284

Merge remote-tracking branch 'source/master' into http-proxy-resolver

18deeb8

fix udeps

0428123

fixes

dd4f6bc

arjan-bal requested review from dfawley and ejona86 June 18, 2026 18:42

arjan-bal assigned ejona86 and dfawley Jun 18, 2026

ejona86 reviewed Jun 18, 2026

View reviewed changes

arjan-bal assigned arjan-bal and unassigned ejona86 Jun 22, 2026

arjan-bal mentioned this pull request Jun 22, 2026

grpc/client: HTTP CONNECT proxy support in transport #2698

Open

arjan-bal added 3 commits June 22, 2026 14:18

use builder to resolver authority

c1af9e6

restrict proxy to dns

b0c8289

Merge remote-tracking branch 'source/master' into http-proxy-resolver

24ee71a

arjan-bal assigned ejona86 and unassigned arjan-bal Jun 22, 2026

arjan-bal requested a review from ejona86 June 23, 2026 06:24

dfawley reviewed Jun 30, 2026

View reviewed changes

dfawley assigned arjan-bal and unassigned dfawley Jun 30, 2026

arjan-bal added 2 commits July 1, 2026 15:30

no super import, infallible constructor

09dfb94

move proxy opts to transport mod

b2f47f5

arjan-bal force-pushed the http-proxy-resolver branch from 5395e05 to b2f47f5 Compare July 1, 2026 10:21

Merge remote-tracking branch 'source/master' into http-proxy-resolver

c3c4234

arjan-bal assigned dfawley and unassigned ejona86 and arjan-bal Jul 1, 2026

dfawley approved these changes Jul 1, 2026

View reviewed changes

rustdoc and variable rename

8a1e72a

arjan-bal assigned arjan-bal and unassigned dfawley Jul 3, 2026

arjan-bal merged commit b68df9f into grpc:master Jul 3, 2026
26 checks passed

arjan-bal deleted the http-proxy-resolver branch July 3, 2026 09:21

	Host::Ipv4(ipv4) => {
	return nop_resolver_for_ip(IpAddr::V4(ipv4), endpoint.port, options);
	}
	Host::Ipv6(ipv6) => {
	return nop_resolver_for_ip(IpAddr::V6(ipv6), endpoint.port, options);
	}

Uh oh!

Conversation

arjan-bal commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arjan-bal commented Jun 8, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

arjan-bal commented Jun 8, 2026 •

edited

Loading