config: accept hostname for [domain-fronting] target

example.config.toml

@@ -112,11 +112,19 @@ allow-fallback-on-unknown-dc = false
 # required.
 [domain-fronting]
 # By default, mtg resolves the fronting hostname (from the secret) via DNS
-# to establish a TCP connection. If DNS resolution of that hostname is blocked,
-# you can specify an IP address to connect to directly. The hostname is still
-# used for SNI in the TLS handshake.
+# to establish a TCP connection. If that resolution is blocked, or loops
+# back to this server (e.g. mtg sits behind an SNI router whose DNS points
+# at itself), override the destination here.
 #
-# default value is not set (DNS resolution is used).
+# Use `host` — accepts a hostname or a literal IP. Hostnames are resolved
+# at dial time, so a dual-stack DNS record can reach the right backend
+# address family for IPv4 or IPv6 clients. `ip` is kept for backward
+# compatibility (literal IP only). Setting both is an error.
+#
+# The hostname from the secret is still used for SNI in the TLS handshake.
+#
+# default value is not set (the secret's hostname is used).
+# host = "fronting-backend"
 # ip = "10.10.10.11"
 
 # FakeTLS uses domain fronting protection. So it needs to know a port to

internal/cli/doctor.go

@@ -298,8 +298,8 @@ func (d *Doctor) checkNetworkAddresses(ntw mtglib.Network, addresses []string) e
 
 func (d *Doctor) checkFrontingDomain(ntw mtglib.Network) bool {
 	host := d.conf.Secret.Host
-	if ip := d.conf.GetDomainFrontingIP(nil); ip != "" {
-		host = ip
+	if override := d.conf.GetDomainFrontingHost(); override != "" {
+		host = override
 	}
 
 	port := d.conf.GetDomainFrontingPort(mtglib.DefaultDomainFrontingPort)

internal/cli/run_proxy.go

@@ -343,7 +343,7 @@ func runProxy(conf *config.Config, version string) error { //nolint: funlen, cyc
 		Secret:                      conf.Secret,
 		Concurrency:                 conf.GetConcurrency(mtglib.DefaultConcurrency),
 		DomainFrontingPort:          conf.GetDomainFrontingPort(mtglib.DefaultDomainFrontingPort),
-		DomainFrontingIP:            conf.GetDomainFrontingIP(nil),
+		DomainFrontingIP:            conf.GetDomainFrontingHost(),
 		DomainFrontingProxyProtocol: conf.GetDomainFrontingProxyProtocol(false),
 		PreferIP:                    conf.PreferIP.Get(mtglib.DefaultPreferIP),
 		AutoUpdate:                  conf.AutoUpdate.Get(false),

internal/config/config.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"net"
 	"net/url"
 
 	"github.com/9seconds/mtg/v2/mtglib"
@@ -38,6 +37,7 @@ type Config struct {
 	PublicIPv4                  TypeIP          `json:"publicIpv4"`
 	PublicIPv6                  TypeIP          `json:"publicIpv6"`
 	DomainFronting              struct {
+		Host          TypeHost `json:"host"`
 		IP            TypeIP   `json:"ip"`
 		Port          TypePort `json:"port"`
 		ProxyProtocol TypeBool `json:"proxyProtocol"`
@@ -117,11 +117,14 @@ func (c *Config) GetDomainFrontingPort(defaultValue uint) uint {
 	return c.DomainFrontingPort.Get(defaultValue)
 }
 
-func (c *Config) GetDomainFrontingIP(defaultValue net.IP) string {
+func (c *Config) GetDomainFrontingHost() string {
+	if host := c.DomainFronting.Host.Get(""); host != "" {
+		return host
+	}
 	if ip := c.DomainFronting.IP.Get(nil); ip != nil {
 		return ip.String()
 	}
-	if ip := c.DomainFrontingIP.Get(defaultValue); ip != nil {
+	if ip := c.DomainFrontingIP.Get(nil); ip != nil {
 		return ip.String()
 	}
 	return ""
@@ -140,6 +143,10 @@ func (c *Config) Validate() error {
 		return fmt.Errorf("incorrect bind-to parameter %s", c.BindTo.String())
 	}
 
+	if c.DomainFronting.Host.Get("") != "" && c.DomainFronting.IP.Get(nil) != nil {
+		return fmt.Errorf("[domain-fronting] host and ip are mutually exclusive; pick one")
+	}
+
 	return nil
 }
 

internal/config/config_test.go

@@ -74,6 +74,43 @@ func (suite *ConfigTestSuite) TestString() {
 	suite.NotEmpty(conf.String())
 }
 
+func (suite *ConfigTestSuite) TestDomainFrontingHostAndIPMutuallyExclusive() {
+	conf, err := config.Parse(suite.ReadConfig("minimal.toml"))
+	suite.NoError(err)
+
+	suite.NoError(conf.DomainFronting.Host.Set("fronting-backend"))
+	suite.NoError(conf.DomainFronting.IP.Set("10.0.0.10"))
+	suite.Error(conf.Validate())
+}
+
+func (suite *ConfigTestSuite) TestDomainFrontingHostFromTOML() {
+	conf, err := config.Parse(suite.ReadConfig("domain_fronting_host.toml"))
+	suite.NoError(err)
+	suite.NoError(conf.Validate())
+	suite.Equal("fronting-backend", conf.GetDomainFrontingHost())
+}
+
+func (suite *ConfigTestSuite) TestDomainFrontingHostAcceptsLiteralIP() {
+	conf, err := config.Parse(suite.ReadConfig("domain_fronting_host_ip.toml"))
+	suite.NoError(err)
+	suite.NoError(conf.Validate())
+	suite.Equal("10.0.0.1", conf.GetDomainFrontingHost())
+}
+
+func (suite *ConfigTestSuite) TestDomainFrontingIPFromTOML() {
+	conf, err := config.Parse(suite.ReadConfig("domain_fronting_ip.toml"))
+	suite.NoError(err)
+	suite.NoError(conf.Validate())
+	suite.Equal("10.0.0.10", conf.GetDomainFrontingHost())
+}
+
+func (suite *ConfigTestSuite) TestDomainFrontingNotSet() {
+	conf, err := config.Parse(suite.ReadConfig("minimal.toml"))
+	suite.NoError(err)
+	suite.NoError(conf.Validate())
+	suite.Equal("", conf.GetDomainFrontingHost())
+}
+
 func TestConfig(t *testing.T) {
 	t.Parallel()
 	suite.Run(t, &ConfigTestSuite{})

internal/config/parse.go

@@ -24,6 +24,7 @@ type tomlConfig struct {
 	PublicIPv4                  string `toml:"public-ipv4" json:"publicIpv4,omitempty"`
 	PublicIPv6                  string `toml:"public-ipv6" json:"publicIpv6,omitempty"`
 	DomainFronting              struct {
+		Host          string `toml:"host" json:"host,omitempty"`
 		IP            string `toml:"ip" json:"ip,omitempty"`
 		Port          uint   `toml:"port" json:"port,omitempty"`
 		ProxyProtocol bool   `toml:"proxy-protocol" json:"proxyProtocol,omitempty"`

internal/config/testdata/domain_fronting_host.toml

@@ -0,0 +1,5 @@
+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+
+[domain-fronting]
+host = "fronting-backend"

internal/config/testdata/domain_fronting_host_ip.toml

@@ -0,0 +1,5 @@
+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+
+[domain-fronting]
+host = "10.0.0.1"

internal/config/testdata/domain_fronting_ip.toml

@@ -0,0 +1,5 @@
+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+
+[domain-fronting]
+ip = "10.0.0.10"

internal/config/type_host.go

@@ -0,0 +1,61 @@
+package config
+
+import (
+	"fmt"
+	"net"
+	"strings"
+)
+
+// TypeHost is a non-empty string that is either a literal IP address
+// (IPv4 or IPv6) or a hostname suitable for DNS resolution. It does not
+// include a port — the port belongs in a separate field.
+type TypeHost struct {
+	Value string
+}
+
+func (t *TypeHost) Set(value string) error {
+	if value == "" {
+		return fmt.Errorf("host cannot be empty")
+	}
+
+	if net.ParseIP(value) != nil {
+		t.Value = value
+
+		return nil
+	}
+
+	if strings.ContainsAny(value, " \t\n/?#") {
+		return fmt.Errorf("incorrect host %q", value)
+	}
+
+	// At this point value is not a parsed IP (IPv6 literals returned
+	// above), so any remaining colon indicates a host:port form, which
+	// belongs in a separate field.
+	if strings.Contains(value, ":") {
+		return fmt.Errorf("host must not contain a port: %q", value)
+	}
+
+	t.Value = value
+
+	return nil
+}
+
+func (t TypeHost) Get(defaultValue string) string {
+	if t.Value == "" {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeHost) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeHost) MarshalText() ([]byte, error) {
+	return []byte(t.Value), nil
+}
+
+func (t TypeHost) String() string {
+	return t.Value
+}

internal/config/type_host_test.go

@@ -0,0 +1,77 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeHostTestStruct struct {
+	Value config.TypeHost `json:"value"`
+}
+
+type TypeHostTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeHostTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"web:8443",
+		"http://example.com",
+		"example.com/path",
+		"two words",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeHostTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeHostTestSuite) TestUnmarshalOk() {
+	testData := []string{
+		"example.com",
+		"web",
+		"sub.example.com",
+		"127.0.0.1",
+		"2001:db8::1",
+	}
+
+	for _, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": value,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(value, func(t *testing.T) {
+			testStruct := &typeHostTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.Equal(t, value, testStruct.Value.Get(""))
+		})
+	}
+}
+
+func (suite *TypeHostTestSuite) TestGet() {
+	value := config.TypeHost{}
+	suite.Equal("default", value.Get("default"))
+
+	suite.NoError(value.Set("example.com"))
+	suite.Equal("example.com", value.Get("default"))
+}
+
+func TestTypeHost(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeHostTestSuite{})
+}

mtglib/proxy.go

@@ -30,7 +30,7 @@ type Proxy struct {
 	idleTimeout                 time.Duration
 	handshakeTimeout            time.Duration
 	domainFrontingPort          int
-	domainFrontingIP            string
+	domainFrontingHost          string
 	domainFrontingProxyProtocol bool
 	workerPool                  *ants.PoolWithFunc
 	telegram                    *dc.Telegram
@@ -48,11 +48,12 @@ type Proxy struct {
 }
 
 // DomainFrontingAddress returns a host:port pair for a fronting domain.
-// If DomainFrontingIP is set, it is used instead of resolving the hostname.
+// If a fronting host (literal IP or hostname) is configured, it is used
+// instead of resolving the secret's hostname.
 func (p *Proxy) DomainFrontingAddress() string {
 	host := p.secret.Host
-	if p.domainFrontingIP != "" {
-		host = p.domainFrontingIP
+	if p.domainFrontingHost != "" {
+		host = p.domainFrontingHost
 	}
 
 	return net.JoinHostPort(host, strconv.Itoa(p.domainFrontingPort))
@@ -354,7 +355,7 @@ func NewProxy(opts ProxyOpts) (*Proxy, error) {
 		eventStream:              opts.EventStream,
 		logger:                   logger,
 		domainFrontingPort:       opts.getDomainFrontingPort(),
-		domainFrontingIP:         opts.DomainFrontingIP,
+		domainFrontingHost:       opts.DomainFrontingIP,
 		tolerateTimeSkewness:     opts.getTolerateTimeSkewness(),
 		idleTimeout:              opts.getIdleTimeout(),
 		handshakeTimeout:         opts.getHandshakeTimeout(),

mtglib/proxy_opts.go

@@ -105,11 +105,14 @@ type ProxyOpts struct {
 	// This is an optional setting.
 	DomainFrontingPort uint
 
-	// DomainFrontingIP is an IP address to use when connecting to the fronting
-	// domain instead of resolving the hostname from the secret via DNS.
-	//
-	// This is useful when DNS resolution of the fronting host is blocked.
-	// The hostname from the secret is still used for SNI in the TLS handshake.
+	// DomainFrontingIP is the address to use when connecting to the fronting
+	// domain instead of resolving the hostname from the secret via DNS. It
+	// can be a literal IP or a hostname; hostnames are resolved at dial time
+	// via the native dialer (which honours dual-stack and Happy Eyeballs).
+	//
+	// This is useful when DNS resolution of the secret's hostname is blocked
+	// or loops back to this server. The hostname from the secret is still
+	// used for SNI in the TLS handshake.
 	//
 	// This is an optional setting.
 	DomainFrontingIP string