Commit c2b37fc

committed

HTTP/2 CONNECT proxy with mTLS client auth and policy enforcement

Proxy accepts HTTP/2 CONNECT requests over mTLS, extracts a custom X.509 extension from the client certificate, and evaluates it against a TOML policy to authorize connections to requested destinations. Allowed connections are tunneled as opaque TCP via bidirectional byte copy. Includes structured logging (tracing), OpenTelemetry export, Prometheus metrics, and a comprehensive test suite (38 integration + 8 e2e tests covering tunnel success, policy denial, extension enforcement, mTLS fail-closed, unreachable destinations, and method rejection).

0 parents  commit c2b37fcCopy full SHA for c2b37fc

15 files changed

.gitignore
Cargo.lock
Cargo.toml
README.md
config.example.toml
src
tests
- common
  - mod.rs
- e2e.rs
- integration.rs

`‎.gitignore‎`

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+/target`
	`2`	`+__pycache__/`

Comments

(0)