Go server that can conditionally forward or terminate incoming TLS connections

My overall goal is the following: I would like to write a Go server that accepts incoming TLS connections and examines the server name indicated by the client via the TLS SNI extension. Depending on the server name, my server will either:

1. forward (reverse-proxy) the TCP connection to a different server, without terminating TLS, or
2. terminate TLS and handles the request itself

This excellent blog post describes a reverse proxy that examines the SNI extension and either forwards the connection elsewhere or else terminates it. The basic trick is to peek enough bytes from the TCP connection to parse the TLS ClientHello, and if the server name should be forwarded, the reverse proxy opens a TCP connection to the final destination, writes the peeked bytes to the connection, then sets up goroutines to copy the rest of the bytes until close between the TCP connection from the client and the connection to the final destination. Following the model in that post, I'm able to implement behavior 1 with few changes.

The problem is with the other case, behavior 2, when my server should terminate TLS and handle the application-layer HTTP request itself. I'm using the Go standard library's HTTP server, but its APIs don't have what I need. Specifically, after I've peeked the ClientHello and determined the connection should be handled by my server, there's no way to pass the net.Conn to an existing http.Server. I need an API something like:

// Does not actually exist
func (srv *http.Server) HandleConnection(c net.Conn) error

but the closest I can get is

func (srv *http.Server) Serve(l net.Listener) error

or the TLS equivalent,

func (srv *http.Server) ServeTLS(l net.Listener, certFile, keyFile string) error

both of which accept net.Listener, and do their own for-accept loop internally.

Right now, the only way forward I can think of is to create my own "synthetic" net.Listener backed by a Go channel, which I pass to func (srv *http.Server) ServeTLS. Then, when I receive a connection from the real TCP net.Listener that the server should handle itself, I send the connection to the synthetic listener, which causes that listener's Accept to return the new connection to the waiting http.Server. This solution doesn't feel great, though, and I'm looking for something that will achieve my overall goal more cleanly.

Here's a simplified version of what I'm trying to do. The TODO marks the part where I don't know how to proceed.

func main() {
l, _ := net.Listen("tcp", ":443")
// Server to handle request that should be handled directly
server := http.Server{
// Config omitted for brevity
}
for {
conn, err := l.Accept()
if err != nil {
continue
}
go handleConnection(conn, &server)
}
}
func handleConnection(clientConn net.Conn, server *http.Server) {
defer clientConn.Close()
clientHello, clientReader, _ := peekClientHello(clientConn)
if shouldHandleServerName(clientHello.ServerName) {
// Terminate TLS and handle it ourselves
// TODO: How to use `server` to handle `clientConn`?
return
}
// Else, forward to another server without terminating TLS
backendConn, _ := net.DialTimeout("tcp", net.JoinHostPort(clientHello.ServerName, "443"), 5*time.Second)
defer backendConn.Close()
var wg sync.WaitGroup
wg.Add(2)
go func() {
io.Copy(clientConn, backendConn)
clientConn.(*net.TCPConn).CloseWrite()
wg.Done()
}()
go func() {
io.Copy(backendConn, clientReader)
backendConn.(*net.TCPConn).CloseWrite()
wg.Done()
}()
wg.Wait()
}
// Returns true if we should handle this connection, and false if we should forward
func shouldHandleServerName(serverName string) bool {
// Implementation omitted for brevity
}
// Reads bytes from reader until it can parse a TLS ClientHello. Returns the
// parsed ClientHello and a new io.Reader that contains all the bytes from the
// original reader, including those that made up the ClientHello, so that the
// connection can be transparently forwarded.
func peekClientHello(reader io.Reader) (*tls.ClientHelloInfo, io.Reader, error) {
// Implementation omitted for brevity, mostly identical to
// https://www.agwa.name/blog/post/writing_an_sni_proxy_in_go
}

The cleanest solution is likely the way you already suggested by implementing a custom net.Listener.

I would modify peekClientHello function to return a net.Conn which in actuality is just a wrapper around an existing net.Conn and a io.TeeReader like the existing function already uses. Now we have a new object which can be copied to the the backend or returned by the Accept function. You can now layer a net.Listener, CustomListener, and tls.Listener.

You would end up with something like this:

func main() {
	// Server to handle request that should be handled directly
	server := http.Server{
		// Config omitted for brevity
	}

	tcpListener, _ := net.Listen("tcp", ":443")
	l := tls.NewListener(
		&CustomListener{
			InnerListener: tcpListener,
		},
		nil, // some custom tls config
	)

	server.Serve(l)
}

type CustomListener struct {
	InnerListener net.Listener
	// TODO add settings to be used by shouldHandleServerName
}

// Accept waits for and returns the next connection to the listener.
func (cl *CustomListener) Accept() (net.Conn, error) {
	for {
		clientConn, err := cl.InnerListener.Accept()
		if err != nil {
			return nil, err
		}

		clientHello, teeConn, _ := peekClientHello(clientConn)

		// Terminate TLS and handle it ourselves
		if !cl.shouldHandleServerName(clientHello.ServerName) {
			return teeConn, err
		}

		go forwardConnection(clientHello.ServerName, teeConn)
	}
}

func forwardConnection(serverName string, clientConn net.Conn) {
	defer clientConn.Close()
	// Else, forward to another server without terminating TLS
	backendConn, _ := net.DialTimeout("tcp", net.JoinHostPort(serverName, "443"), 5*time.Second)
	defer backendConn.Close()

	var wg sync.WaitGroup
	wg.Add(2)

	go func() {
		io.Copy(clientConn, backendConn)
		clientConn.(*net.TCPConn).CloseWrite()
		wg.Done()
	}()
	go func() {
		io.Copy(backendConn, clientConn)
		backendConn.(*net.TCPConn).CloseWrite()
		wg.Done()
	}()

	wg.Wait()
}

// Close closes the listener.
// Any blocked Accept operations will be unblocked and return errors.
func (cl *CustomListener) Close() error {
	return cl.InnerListener.Close()
}

// Addr returns the listener's network address.
func (cl *CustomListener) Addr() net.Addr {
	return cl.InnerListener.Addr()
}

// Returns true if we should handle this connection, and false if we should forward
func (cl *CustomListener) shouldHandleServerName(serverName string) bool {
	// Implementation omitted for brevity
}

// Reads bytes from reader until it can parse a TLS ClientHello. Returns the
// parsed ClientHello and a new net.Conn that contains all the bytes from the
// original reader, including those that made up the ClientHello, so that the
// connection can be transparently forwarded.
func peekClientHello(reader io.Reader) (*tls.ClientHelloInfo, net.Conn, error) {
	// Implementation omitted for brevity, mostly identical to
	// https://www.agwa.name/blog/post/writing_an_sni_proxy_in_go
}