fix(proxyutil): enforce HTTP/1.1 ALPN and configure TLS dial context for HTTPS proxies

- Add `buildHTTPSProxyDialTLSContext` to handle HTTPS proxy TLS handshakes with configurable timeout and TLS options. - Restrict ALPN `NextProtos` to HTTP/1.1 for HTTPS proxy connections to prevent HTTP/2 negotiation issues during proxy CONNECT tunneling. - Support custom TLS configuration in `httpConnectDialer` for HTTPS proxy connections. Closes: #5287
2026-09-03 06:35:00 +08:00 · 2026-08-28 16:50:33 +08:00
parent b5cde4ba42
commit 8dd78042e0
2 changed files with 723 additions and 3 deletions
--- a/sdk/proxyutil/proxy.go
+++ b/sdk/proxyutil/proxy.go
@@ -11,6 +11,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"time"

 	"golang.org/x/net/proxy"
 )
@@ -117,6 +118,12 @@ func BuildHTTPTransport(raw string) (*http.Transport, Mode, error) {
 			}
 			return transport, setting.Mode, nil
 		}
+		if setting.URL.Scheme == "https" {
+			transport := cloneDefaultTransport()
+			transport.Proxy = http.ProxyURL(setting.URL)
+			transport.DialTLSContext = buildHTTPSProxyDialTLSContext(setting.URL, nil, transport.TLSHandshakeTimeout, transport.DialContext)
+			return transport, setting.Mode, nil
+		}
 		transport := cloneDefaultTransport()
 		transport.Proxy = http.ProxyURL(setting.URL)
 		return transport, setting.Mode, nil
@@ -125,6 +132,57 @@ func BuildHTTPTransport(raw string) (*http.Transport, Mode, error) {
 	}
 }

+func buildHTTPSProxyDialTLSContext(
+	proxyURL *url.URL,
+	baseTLS *tls.Config,
+	handshakeTimeout time.Duration,
+	baseDialContext func(ctx context.Context, network, addr string) (net.Conn, error),
+) func(ctx context.Context, network, addr string) (net.Conn, error) {
+	proxyHostname := proxyURL.Hostname()
+	var privateTLS *tls.Config
+	if baseTLS != nil {
+		privateTLS = baseTLS.Clone()
+	}
+	dialContext := baseDialContext
+	if dialContext == nil {
+		dialContext = (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+		}).DialContext
+	}
+	return func(ctx context.Context, network, addr string) (net.Conn, error) {
+		rawConn, errDial := dialContext(ctx, network, addr)
+		if errDial != nil {
+			return nil, errDial
+		}
+		var tlsConfig *tls.Config
+		if privateTLS != nil {
+			tlsConfig = privateTLS.Clone()
+		} else {
+			tlsConfig = &tls.Config{}
+		}
+		if tlsConfig.ServerName == "" {
+			tlsConfig.ServerName = proxyHostname
+		}
+		tlsConfig.NextProtos = []string{"http/1.1"}
+
+		tlsConn := tls.Client(rawConn, tlsConfig)
+		handshakeCtx := ctx
+		if handshakeTimeout > 0 {
+			var cancelHandshake context.CancelFunc
+			handshakeCtx, cancelHandshake = context.WithTimeout(ctx, handshakeTimeout)
+			defer cancelHandshake()
+		}
+		if errHandshake := tlsConn.HandshakeContext(handshakeCtx); errHandshake != nil {
+			if errClose := rawConn.Close(); errClose != nil {
+				return nil, fmt.Errorf("HTTPS proxy TLS handshake failed: %w; close failed: %v", errHandshake, errClose)
+			}
+			return nil, fmt.Errorf("HTTPS proxy TLS handshake failed: %w", errHandshake)
+		}
+		return tlsConn, nil
+	}
+}
+
 // BuildDialer constructs a proxy dialer for settings that operate at the connection layer.
 func BuildDialer(raw string) (proxy.Dialer, Mode, error) {
 	setting, errParse := Parse(raw)
@@ -152,8 +210,9 @@ func BuildDialer(raw string) (proxy.Dialer, Mode, error) {
 }

 type httpConnectDialer struct {
-	proxyURL *url.URL
-	dialer   proxy.Dialer
+	proxyURL  *url.URL
+	dialer    proxy.Dialer
+	tlsConfig *tls.Config
 }

 func (d *httpConnectDialer) Dial(network, addr string) (net.Conn, error) {
@@ -185,7 +244,18 @@ func (d *httpConnectDialer) DialContext(ctx context.Context, network, addr strin
 		}
 	}()
 	if d.proxyURL.Scheme == "https" {
-		tlsConn := tls.Client(conn, &tls.Config{ServerName: d.proxyURL.Hostname()})
+		var tlsConfig *tls.Config
+		if d.tlsConfig != nil {
+			tlsConfig = d.tlsConfig.Clone()
+		} else {
+			tlsConfig = &tls.Config{}
+		}
+		if tlsConfig.ServerName == "" {
+			tlsConfig.ServerName = d.proxyURL.Hostname()
+		}
+		tlsConfig.NextProtos = []string{"http/1.1"}
+
+		tlsConn := tls.Client(conn, tlsConfig)
 		if errHandshake := tlsConn.HandshakeContext(ctx); errHandshake != nil {
 			if errClose := conn.Close(); errClose != nil {
 				return nil, fmt.Errorf("HTTPS proxy TLS handshake failed: %w; close failed: %v", errHandshake, errClose)
--- a/sdk/proxyutil/proxy_test.go
+++ b/sdk/proxyutil/proxy_test.go
@@ -3,11 +3,21 @@ package proxyutil
 import (
 	"bufio"
 	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"io"
+	"math/big"
 	"net"
 	"net/http"
+	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 	"time"
@@ -168,6 +178,50 @@ func TestBuildHTTPTransportSOCKS5HProxy(t *testing.T) {
 	}
 }

+func TestBuildHTTPTransportHTTPSProxyInheritsDefaultTransportSettings(t *testing.T) {
+	t.Parallel()
+
+	transport, mode, errBuild := BuildHTTPTransport("https://proxy.example.com:8443")
+	if errBuild != nil {
+		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)
+	}
+	if mode != ModeProxy {
+		t.Fatalf("mode = %d, want %d", mode, ModeProxy)
+	}
+	if transport == nil {
+		t.Fatal("expected transport, got nil")
+	}
+	if transport.Proxy == nil {
+		t.Fatal("expected HTTPS proxy transport to retain Proxy function")
+	}
+	if transport.DialTLSContext == nil {
+		t.Fatal("expected HTTPS proxy transport to configure custom DialTLSContext")
+	}
+
+	req, errRequest := http.NewRequest(http.MethodGet, "https://example.com", nil)
+	if errRequest != nil {
+		t.Fatalf("http.NewRequest returned error: %v", errRequest)
+	}
+	proxyURL, errProxy := transport.Proxy(req)
+	if errProxy != nil {
+		t.Fatalf("transport.Proxy returned error: %v", errProxy)
+	}
+	if proxyURL == nil || proxyURL.String() != "https://proxy.example.com:8443" {
+		t.Fatalf("proxy URL = %v, want https://proxy.example.com:8443", proxyURL)
+	}
+
+	defaultTransport := mustDefaultTransport(t)
+	if transport.ForceAttemptHTTP2 != defaultTransport.ForceAttemptHTTP2 {
+		t.Fatalf("ForceAttemptHTTP2 = %v, want %v", transport.ForceAttemptHTTP2, defaultTransport.ForceAttemptHTTP2)
+	}
+	if transport.IdleConnTimeout != defaultTransport.IdleConnTimeout {
+		t.Fatalf("IdleConnTimeout = %v, want %v", transport.IdleConnTimeout, defaultTransport.IdleConnTimeout)
+	}
+	if transport.TLSHandshakeTimeout != defaultTransport.TLSHandshakeTimeout {
+		t.Fatalf("TLSHandshakeTimeout = %v, want %v", transport.TLSHandshakeTimeout, defaultTransport.TLSHandshakeTimeout)
+	}
+}
+
 func TestBuildDialerHTTPProxyCONNECT(t *testing.T) {
 	t.Parallel()

@@ -395,3 +449,599 @@ func TestParseErrorDoesNotExposeProxyCredentials(t *testing.T) {
 		t.Fatalf("parse error exposes proxy credentials: %q", errParse.Error())
 	}
 }
+
+func newTestCertificate(t *testing.T) tls.Certificate {
+	t.Helper()
+
+	key, errKey := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if errKey != nil {
+		t.Fatalf("generate test key: %v", errKey)
+	}
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "127.0.0.1"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		IsCA:         true,
+	}
+	der, errCreate := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if errCreate != nil {
+		t.Fatalf("create test certificate: %v", errCreate)
+	}
+	leaf, errParse := x509.ParseCertificate(der)
+	if errParse != nil {
+		t.Fatalf("parse test certificate: %v", errParse)
+	}
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key, Leaf: leaf}
+}
+
+func TestBuildHTTPTransportHTTPSProxyH2Negotiation(t *testing.T) {
+	t.Parallel()
+
+	targetServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = fmt.Fprint(w, "target ok")
+	}))
+	defer targetServer.Close()
+
+	proxyCert := newTestCertificate(t)
+	proxyListener, errListen := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{
+		Certificates: []tls.Certificate{proxyCert},
+		NextProtos:   []string{"h2", "http/1.1"},
+	})
+	if errListen != nil {
+		t.Fatalf("tls.Listen returned error: %v", errListen)
+	}
+	defer func() {
+		if errClose := proxyListener.Close(); errClose != nil {
+			t.Errorf("proxyListener.Close returned error: %v", errClose)
+		}
+	}()
+
+	proxyDone := make(chan error, 1)
+	go func() {
+		conn, errAccept := proxyListener.Accept()
+		if errAccept != nil {
+			proxyDone <- errAccept
+			return
+		}
+		defer func() { _ = conn.Close() }()
+
+		tlsConn, ok := conn.(*tls.Conn)
+		if !ok {
+			proxyDone <- errors.New("conn is not *tls.Conn")
+			return
+		}
+		if errHandshake := tlsConn.Handshake(); errHandshake != nil {
+			proxyDone <- fmt.Errorf("tls handshake failed: %w", errHandshake)
+			return
+		}
+
+		// When ALPN negotiates h2, a proxy expecting HTTP/2 frames will reject
+		// plain HTTP/1.1 CONNECT requests (reproducing unexpected EOF / bogus greeting).
+		if tlsConn.ConnectionState().NegotiatedProtocol == "h2" {
+			proxyDone <- fmt.Errorf("proxy negotiated h2 ALPN: client must negotiate http/1.1 for CONNECT proxy leg")
+			return
+		}
+
+		req, errRead := http.ReadRequest(bufio.NewReader(tlsConn))
+		if errRead != nil {
+			proxyDone <- fmt.Errorf("read CONNECT request failed: %w", errRead)
+			return
+		}
+		if req.Method != http.MethodConnect {
+			proxyDone <- fmt.Errorf("method = %s, want CONNECT", req.Method)
+			return
+		}
+
+		targetURL, _ := url.Parse(targetServer.URL)
+		targetConn, errDial := net.Dial("tcp", targetURL.Host)
+		if errDial != nil {
+			proxyDone <- fmt.Errorf("dial target failed: %w", errDial)
+			return
+		}
+		defer func() { _ = targetConn.Close() }()
+
+		if _, errWrite := io.WriteString(tlsConn, "HTTP/1.1 200 Connection Established\r\n\r\n"); errWrite != nil {
+			proxyDone <- fmt.Errorf("write CONNECT response failed: %w", errWrite)
+			return
+		}
+
+		go func() {
+			_, _ = io.Copy(targetConn, tlsConn)
+			_ = targetConn.Close()
+		}()
+		_, _ = io.Copy(tlsConn, targetConn)
+		_ = tlsConn.Close()
+		proxyDone <- nil
+	}()
+
+	proxyURL := "https://" + proxyListener.Addr().String()
+	transport, mode, errBuild := BuildHTTPTransport(proxyURL)
+	if errBuild != nil {
+		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)
+	}
+	if mode != ModeProxy {
+		t.Fatalf("mode = %d, want %d", mode, ModeProxy)
+	}
+
+	// Trust proxy cert in DialTLSContext and target cert in TLSClientConfig
+	certPool := x509.NewCertPool()
+	certPool.AddCert(proxyCert.Leaf)
+	parsedProxyURL, _ := url.Parse(proxyURL)
+	transport.DialTLSContext = buildHTTPSProxyDialTLSContext(parsedProxyURL, &tls.Config{RootCAs: certPool}, transport.TLSHandshakeTimeout, transport.DialContext)
+
+	targetCertPool := x509.NewCertPool()
+	for _, cert := range targetServer.TLS.Certificates {
+		if x509Cert, errParse := x509.ParseCertificate(cert.Certificate[0]); errParse == nil {
+			targetCertPool.AddCert(x509Cert)
+		}
+	}
+	transport.TLSClientConfig = &tls.Config{RootCAs: targetCertPool}
+
+	client := &http.Client{
+		Transport: transport,
+		Timeout:   5 * time.Second,
+	}
+
+	req, errReq := http.NewRequest(http.MethodGet, targetServer.URL, nil)
+	if errReq != nil {
+		t.Fatalf("http.NewRequest returned error: %v", errReq)
+	}
+	req.Close = true
+
+	resp, errGet := client.Do(req)
+	if errGet != nil {
+		t.Fatalf("client.Do returned error: %v", errGet)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	body, errBody := io.ReadAll(resp.Body)
+	if errBody != nil {
+		t.Fatalf("read response body failed: %v", errBody)
+	}
+	if string(body) != "target ok" {
+		t.Fatalf("body = %q, want %q", string(body), "target ok")
+	}
+
+	transport.CloseIdleConnections()
+
+	if errProxy := <-proxyDone; errProxy != nil {
+		t.Fatalf("proxy returned error: %v", errProxy)
+	}
+}
+
+func TestBuildHTTPTransportHTTPSProxyHTTPTarget(t *testing.T) {
+	t.Parallel()
+
+	targetServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = fmt.Fprint(w, "http target ok")
+	}))
+	defer targetServer.Close()
+
+	proxyCert := newTestCertificate(t)
+	proxyListener, errListen := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{
+		Certificates: []tls.Certificate{proxyCert},
+		NextProtos:   []string{"h2", "http/1.1"},
+	})
+	if errListen != nil {
+		t.Fatalf("tls.Listen returned error: %v", errListen)
+	}
+	defer func() {
+		if errClose := proxyListener.Close(); errClose != nil {
+			t.Errorf("proxyListener.Close returned error: %v", errClose)
+		}
+	}()
+
+	proxyDone := make(chan error, 1)
+	go func() {
+		conn, errAccept := proxyListener.Accept()
+		if errAccept != nil {
+			proxyDone <- errAccept
+			return
+		}
+		defer func() { _ = conn.Close() }()
+
+		tlsConn, ok := conn.(*tls.Conn)
+		if !ok {
+			proxyDone <- errors.New("conn is not *tls.Conn")
+			return
+		}
+		if errHandshake := tlsConn.Handshake(); errHandshake != nil {
+			proxyDone <- fmt.Errorf("tls handshake failed: %w", errHandshake)
+			return
+		}
+
+		if proto := tlsConn.ConnectionState().NegotiatedProtocol; proto != "http/1.1" {
+			proxyDone <- fmt.Errorf("proxy negotiated %q, want http/1.1", proto)
+			return
+		}
+
+		req, errRead := http.ReadRequest(bufio.NewReader(tlsConn))
+		if errRead != nil {
+			proxyDone <- fmt.Errorf("read request failed: %w", errRead)
+			return
+		}
+		// Plain HTTP target via forward proxy sends standard GET http://host/path
+		if req.Method != http.MethodGet {
+			proxyDone <- fmt.Errorf("method = %s, want GET", req.Method)
+			return
+		}
+
+		targetURL, _ := url.Parse(targetServer.URL)
+		targetConn, errDial := net.Dial("tcp", targetURL.Host)
+		if errDial != nil {
+			proxyDone <- fmt.Errorf("dial target failed: %w", errDial)
+			return
+		}
+		defer func() { _ = targetConn.Close() }()
+
+		if errWrite := req.Write(targetConn); errWrite != nil {
+			proxyDone <- fmt.Errorf("write to target failed: %w", errWrite)
+			return
+		}
+
+		targetResp, errTargetResp := http.ReadResponse(bufio.NewReader(targetConn), req)
+		if errTargetResp != nil {
+			proxyDone <- fmt.Errorf("read target response failed: %w", errTargetResp)
+			return
+		}
+		defer func() { _ = targetResp.Body.Close() }()
+
+		if errWrite := targetResp.Write(tlsConn); errWrite != nil {
+			proxyDone <- fmt.Errorf("write response to proxy client failed: %w", errWrite)
+			return
+		}
+
+		proxyDone <- nil
+	}()
+
+	proxyURL := "https://" + proxyListener.Addr().String()
+	transport, mode, errBuild := BuildHTTPTransport(proxyURL)
+	if errBuild != nil {
+		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)
+	}
+	if mode != ModeProxy {
+		t.Fatalf("mode = %d, want %d", mode, ModeProxy)
+	}
+
+	certPool := x509.NewCertPool()
+	certPool.AddCert(proxyCert.Leaf)
+	parsedProxyURL, _ := url.Parse(proxyURL)
+	transport.DialTLSContext = buildHTTPSProxyDialTLSContext(parsedProxyURL, &tls.Config{RootCAs: certPool}, transport.TLSHandshakeTimeout, transport.DialContext)
+
+	client := &http.Client{
+		Transport: transport,
+		Timeout:   5 * time.Second,
+	}
+
+	req, errReq := http.NewRequest(http.MethodGet, targetServer.URL, nil)
+	if errReq != nil {
+		t.Fatalf("http.NewRequest returned error: %v", errReq)
+	}
+	req.Close = true
+
+	resp, errGet := client.Do(req)
+	if errGet != nil {
+		t.Fatalf("client.Do returned error: %v", errGet)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	body, errBody := io.ReadAll(resp.Body)
+	if errBody != nil {
+		t.Fatalf("read response body failed: %v", errBody)
+	}
+	if string(body) != "http target ok" {
+		t.Fatalf("body = %q, want %q", string(body), "http target ok")
+	}
+
+	transport.CloseIdleConnections()
+
+	if errProxy := <-proxyDone; errProxy != nil {
+		t.Fatalf("proxy returned error: %v", errProxy)
+	}
+}
+
+func TestBuildDialerHTTPSProxyCONNECT(t *testing.T) {
+	t.Parallel()
+
+	proxyCert := newTestCertificate(t)
+	proxyListener, errListen := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{
+		Certificates: []tls.Certificate{proxyCert},
+		NextProtos:   []string{"h2", "http/1.1"},
+	})
+	if errListen != nil {
+		t.Fatalf("tls.Listen returned error: %v", errListen)
+	}
+	defer func() {
+		if errClose := proxyListener.Close(); errClose != nil {
+			t.Errorf("proxyListener.Close returned error: %v", errClose)
+		}
+	}()
+
+	done := make(chan error, 1)
+	go func() {
+		conn, errAccept := proxyListener.Accept()
+		if errAccept != nil {
+			done <- errAccept
+			return
+		}
+		defer func() { _ = conn.Close() }()
+
+		tlsConn, ok := conn.(*tls.Conn)
+		if !ok {
+			done <- errors.New("conn is not *tls.Conn")
+			return
+		}
+		if errHandshake := tlsConn.Handshake(); errHandshake != nil {
+			done <- fmt.Errorf("tls handshake failed: %w", errHandshake)
+			return
+		}
+
+		if proto := tlsConn.ConnectionState().NegotiatedProtocol; proto != "http/1.1" {
+			done <- fmt.Errorf("negotiated protocol = %q, want http/1.1", proto)
+			return
+		}
+
+		req, errRead := http.ReadRequest(bufio.NewReader(tlsConn))
+		if errRead != nil {
+			done <- fmt.Errorf("read CONNECT request failed: %w", errRead)
+			return
+		}
+		if req.Method != http.MethodConnect {
+			done <- fmt.Errorf("method = %s, want CONNECT", req.Method)
+			return
+		}
+		if req.Host != "target.example.com:443" {
+			done <- fmt.Errorf("host = %s, want target.example.com:443", req.Host)
+			return
+		}
+		wantAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte("user:pass"))
+		if gotAuth := req.Header.Get("Proxy-Authorization"); gotAuth != wantAuth {
+			done <- fmt.Errorf("Proxy-Authorization = %q, want %q", gotAuth, wantAuth)
+			return
+		}
+
+		if _, errWrite := io.WriteString(tlsConn, "HTTP/1.1 200 Connection Established\r\n\r\nok"); errWrite != nil {
+			done <- fmt.Errorf("write CONNECT response failed: %w", errWrite)
+			return
+		}
+
+		buf := make([]byte, 4)
+		n, errReadTunnel := io.ReadFull(tlsConn, buf)
+		if errReadTunnel != nil {
+			done <- fmt.Errorf("read tunneled payload failed after %d bytes: %w", n, errReadTunnel)
+			return
+		}
+		if string(buf) != "ping" {
+			done <- fmt.Errorf("tunneled payload = %q, want ping", string(buf))
+			return
+		}
+		done <- nil
+	}()
+
+	dialer, mode, errBuild := BuildDialer("https://user:pass@" + proxyListener.Addr().String())
+	if errBuild != nil {
+		t.Fatalf("BuildDialer returned error: %v", errBuild)
+	}
+	if mode != ModeProxy {
+		t.Fatalf("mode = %d, want %d", mode, ModeProxy)
+	}
+	httpDialer, ok := dialer.(*httpConnectDialer)
+	if !ok {
+		t.Fatalf("dialer type = %T, want *httpConnectDialer", dialer)
+	}
+	certPool := x509.NewCertPool()
+	certPool.AddCert(proxyCert.Leaf)
+	httpDialer.tlsConfig = &tls.Config{RootCAs: certPool}
+
+	conn, errDial := dialer.Dial("tcp", "target.example.com:443")
+	if errDial != nil {
+		t.Fatalf("dialer.Dial returned error: %v", errDial)
+	}
+	defer func() {
+		if errClose := conn.Close(); errClose != nil {
+			t.Errorf("conn.Close returned error: %v", errClose)
+		}
+	}()
+
+	buf := make([]byte, 2)
+	n, errRead := io.ReadFull(conn, buf)
+	if errRead != nil {
+		t.Fatalf("conn.Read returned error after %d bytes: %v", n, errRead)
+	}
+	if string(buf) != "ok" {
+		t.Fatalf("buffered tunnel payload = %q, want ok", string(buf))
+	}
+
+	if _, errWrite := conn.Write([]byte("ping")); errWrite != nil {
+		t.Fatalf("conn.Write returned error: %v", errWrite)
+	}
+
+	if errServer := <-done; errServer != nil {
+		t.Fatalf("proxy server returned error: %v", errServer)
+	}
+}
+
+func TestBuildHTTPTransportHTTPSProxyTLSHandshakeTimeout(t *testing.T) {
+	t.Parallel()
+
+	listener, errListen := net.Listen("tcp", "127.0.0.1:0")
+	if errListen != nil {
+		t.Fatalf("net.Listen returned error: %v", errListen)
+	}
+	defer func() {
+		if errClose := listener.Close(); errClose != nil {
+			t.Errorf("listener.Close returned error: %v", errClose)
+		}
+	}()
+
+	go func() {
+		conn, errAccept := listener.Accept()
+		if errAccept != nil {
+			return
+		}
+		defer func() { _ = conn.Close() }()
+		// Stall indefinitely without performing TLS handshake
+		time.Sleep(2 * time.Second)
+	}()
+
+	proxyURL := "https://" + listener.Addr().String()
+	transport, mode, errBuild := BuildHTTPTransport(proxyURL)
+	if errBuild != nil {
+		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)
+	}
+	if mode != ModeProxy {
+		t.Fatalf("mode = %d, want %d", mode, ModeProxy)
+	}
+
+	transport.TLSHandshakeTimeout = 50 * time.Millisecond
+	parsedProxyURL, _ := url.Parse(proxyURL)
+	transport.DialTLSContext = buildHTTPSProxyDialTLSContext(parsedProxyURL, nil, transport.TLSHandshakeTimeout, transport.DialContext)
+
+	client := &http.Client{
+		Transport: transport,
+		Timeout:   2 * time.Second,
+	}
+
+	start := time.Now()
+	_, errGet := client.Get("https://example.com/test")
+	duration := time.Since(start)
+
+	if errGet == nil {
+		t.Fatal("expected error due to TLS handshake timeout, got nil")
+	}
+	if duration >= time.Second {
+		t.Fatalf("request took %v, expected TLSHandshakeTimeout of 50ms to abort sooner", duration)
+	}
+}
+
+func TestBuildHTTPTransportHTTPSProxyClonedTransport(t *testing.T) {
+	t.Parallel()
+
+	targetServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = fmt.Fprint(w, "cloned target ok")
+	}))
+	defer targetServer.Close()
+
+	proxyCert := newTestCertificate(t)
+	proxyListener, errListen := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{
+		Certificates: []tls.Certificate{proxyCert},
+		NextProtos:   []string{"h2", "http/1.1"},
+	})
+	if errListen != nil {
+		t.Fatalf("tls.Listen returned error: %v", errListen)
+	}
+	defer func() {
+		if errClose := proxyListener.Close(); errClose != nil {
+			t.Errorf("proxyListener.Close returned error: %v", errClose)
+		}
+	}()
+
+	proxyDone := make(chan error, 1)
+	go func() {
+		conn, errAccept := proxyListener.Accept()
+		if errAccept != nil {
+			proxyDone <- errAccept
+			return
+		}
+		defer func() { _ = conn.Close() }()
+
+		tlsConn, ok := conn.(*tls.Conn)
+		if !ok {
+			proxyDone <- errors.New("conn is not *tls.Conn")
+			return
+		}
+		if errHandshake := tlsConn.Handshake(); errHandshake != nil {
+			proxyDone <- fmt.Errorf("tls handshake failed: %w", errHandshake)
+			return
+		}
+
+		if proto := tlsConn.ConnectionState().NegotiatedProtocol; proto != "http/1.1" {
+			proxyDone <- fmt.Errorf("proxy negotiated %q, want http/1.1", proto)
+			return
+		}
+
+		req, errRead := http.ReadRequest(bufio.NewReader(tlsConn))
+		if errRead != nil {
+			proxyDone <- fmt.Errorf("read request failed: %w", errRead)
+			return
+		}
+
+		targetURL, _ := url.Parse(targetServer.URL)
+		targetConn, errDial := net.Dial("tcp", targetURL.Host)
+		if errDial != nil {
+			proxyDone <- fmt.Errorf("dial target failed: %w", errDial)
+			return
+		}
+		defer func() { _ = targetConn.Close() }()
+
+		if errWrite := req.Write(targetConn); errWrite != nil {
+			proxyDone <- fmt.Errorf("write to target failed: %w", errWrite)
+			return
+		}
+
+		targetResp, errTargetResp := http.ReadResponse(bufio.NewReader(targetConn), req)
+		if errTargetResp != nil {
+			proxyDone <- fmt.Errorf("read target response failed: %w", errTargetResp)
+			return
+		}
+		defer func() { _ = targetResp.Body.Close() }()
+
+		if errWrite := targetResp.Write(tlsConn); errWrite != nil {
+			proxyDone <- fmt.Errorf("write response to proxy client failed: %w", errWrite)
+			return
+		}
+
+		proxyDone <- nil
+	}()
+
+	proxyURL := "https://" + proxyListener.Addr().String()
+	transport, mode, errBuild := BuildHTTPTransport(proxyURL)
+	if errBuild != nil {
+		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)
+	}
+	if mode != ModeProxy {
+		t.Fatalf("mode = %d, want %d", mode, ModeProxy)
+	}
+
+	certPool := x509.NewCertPool()
+	certPool.AddCert(proxyCert.Leaf)
+	parsedProxyURL, _ := url.Parse(proxyURL)
+	transport.DialTLSContext = buildHTTPSProxyDialTLSContext(parsedProxyURL, &tls.Config{RootCAs: certPool}, transport.TLSHandshakeTimeout, transport.DialContext)
+
+	clonedTransport := transport.Clone()
+
+	client := &http.Client{
+		Transport: clonedTransport,
+		Timeout:   5 * time.Second,
+	}
+
+	req, errReq := http.NewRequest(http.MethodGet, targetServer.URL, nil)
+	if errReq != nil {
+		t.Fatalf("http.NewRequest returned error: %v", errReq)
+	}
+	req.Close = true
+
+	resp, errGet := client.Do(req)
+	if errGet != nil {
+		t.Fatalf("client.Do returned error: %v", errGet)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	body, errBody := io.ReadAll(resp.Body)
+	if errBody != nil {
+		t.Fatalf("read response body failed: %v", errBody)
+	}
+	if string(body) != "cloned target ok" {
+		t.Fatalf("body = %q, want %q", string(body), "cloned target ok")
+	}
+
+	clonedTransport.CloseIdleConnections()
+
+	if errProxy := <-proxyDone; errProxy != nil {
+		t.Fatalf("proxy returned error: %v", errProxy)
+	}
+}