High-Performance HTTP Proxy

Project roadmap

1. 01

   Design the proxy

   ~2h

   Write DESIGN.md: the requests handled (plain HTTP with absolute URLs, and CONNECT for HTTPS tunnels), the rules file (denied domains with wildcards such as *.ads.example, allowed client address ranges), the limits (per-client and total connections, header size, and connect, idle and total timeouts), the log format, and how shutdown and rule reloading work. Done when: DESIGN.md covers requests, rules, limits and lifecycle.

2. 02

   Forward plain HTTP requests

   ~3h

   Accept connections with Boost.Asio, read requests with Boost.Beast's http::async_read (with a body size limit), resolve and connect to the target host asynchronously, forward the request (removing hop-by-hop headers such as Proxy-Connection), and stream the response back. Support keep-alive with the client. Done when: curl -x http://localhost:8080 http://example.com returns the page.

3. 03

   Tunnel HTTPS with CONNECT

   ~2.5h

   For CONNECT requests, check the rules, connect to the target host and port (only allowing port 443 by default), answer 200 Connection Established, then copy bytes in both directions between the two sockets until either side closes, without reading the encrypted content. Done when: curl -x http://localhost:8080 https://example.com works.

4. 04

   Apply rules and limits

   ~2.5h

   Check each request's host against the deny list and return 403 with a short explanation, and refuse clients outside the allowed ranges. Enforce per-client and total connection limits (return 503 or refuse the connection), header size limits, and connect, idle and total timeouts with steady_timer. Reload the rules file on SIGHUP, only switching when the new file is valid. Done when: denied domains get 403, and limits and timeouts work.

5. 05

   Log and observe

   ~1.5h

   Write an access log line for every request: time, client address, method, host, path (or host and port for CONNECT), status, bytes in each direction and duration, through a dedicated logging thread so request handling never waits for the disk. Keep counters (active connections, requests, denials and timeouts) and print them periodically or on SIGUSR1. Done when: the log shows every request, and the counters are accurate.

6. 06

   Run on threads and shut down gracefully

   ~2h

   Run the io_context on several threads, using strands so each connection's handlers never run at the same time. On SIGTERM, stop accepting, let active requests finish up to a deadline, then close the rest and exit. Done when: the proxy handles many clients at once, and shutting down mid-transfer lets short requests finish.

7. 07

   Test and measure

   ~2.5h

   Write integration tests that start the proxy and a local test HTTP server: forwarding, keep-alive, CONNECT tunneling to a local TLS server, deny rules, connection limits, timeouts with a server that never answers, and rule reloading. Measure throughput on your own machine with wrk through the proxy and record it in README.md. Run tests under AddressSanitizer and ThreadSanitizer. Done when: all tests pass with no sanitizer errors.

Resources

• DocsBoost.Beast documentation
• DocsBoost.Asio documentation
• DocsMDN: CONNECT method
• DocsRFC 9110: HTTP semantics (proxies)
• Docswrk HTTP benchmarking tool