It looks like #17227 was closed prematurely. The code submitted only returns (and documents that it returns) net.Conn on a protocol upgrade (h2c, websockets, etc), but it never did so for CONNECT responses.

We can keep this bug open for finishing #17227, but it's too late for Go 1.13 at this point.

Thank you @bradfitz . What would be the recommended workaround/way to do a TLS client in golang through an HTTPS (and non-http2) proxy for CONNECT tunneling?

The net/http.Transport already supports CONNECT. I don't know what io.Pipe you're talking about. See https://github.com/golang/go/wiki/Questions for forums where more people are available to help. I don't have much time this week.

@bradfitz sorry for not providing the full context. What I wanted to ask was if there is a way to get net.Conn out of net/http.Transport after a connect request. It doesn't look like that's possible in golang 1.12

// input:
// proxyAddr: string, address of the HTTPS proxy
// backendAddr:              string, address of the backend
// ---
// output:
// client.Conn        *tls.Conn: tls connection for reading/writing radius packets

u, err := url.Parse(proxyAddr)
if err != nil {
    return errors.Annotate(err, "error parsing https proxy url")
}

tr := &http.Transport{
    Proxy:           http.ProxyURL(u),
    TLSNextProto:    make(map[string]func(authority string, c *tls.Conn) http.RoundTripper),
    TLSClientConfig: tlsConfig,
}

req := &http.Request{
    Method: "CONNECT",
    URL: &url.URL{
        Scheme: "https",
        Host:   proxyAddr,
        Opaque: backendAddr,
    },
}
req.Header = make(http.Header)

resp, err := tr.RoundTrip(req)
if err != nil {
    return errors.Annotate(err, "error getting response from https proxy")
}
if resp.StatusCode != 200 {
    return errors.New(fmt.Sprintf("did not get 200 from https proxy, status code: %d", resp.StatusCode))
}

conn, ok := resp.Body.(net.Conn)
if ok != true {
    return errors.New(fmt.Sprintf("resp.Body is not a net.Conn, it has type: %s", reflect.TypeOf(resp.Body)))
}
tlsConn = tls.Client(conn, tlsConfig)

I can pass a io.Pipe to http.NewRequest and then write to the corresponding PipeWriter but that doesn't end up with a net.Conn interface (that can be upgraded to tls.Conn).

No worries, I'm able to do that by simulating a net.Conn

pr, pw := io.Pipe()
req, err := http.NewRequest("CONNECT", fmt.Sprintf("https://%s", proxyAddr), pr)
if err != nil {
    return errors.Annotate(err, "error creating https proxy request")
}
req.ContentLength = -1
req.URL.Opaque = backendAddr
res, err := http.DefaultClient.Do(req)
if err != nil {
    return errors.Annotate(err, "error connecting to https proxy")
}
if res.StatusCode < 200 || res.StatusCode > 299 {
    panic(fmt.Sprintf("error connecting to https proxy, status: %d", res.StatusCode))
}
pc := PipeConn{
    reader:     res.Body,
    writer:     pw,
}
tlsConn = tls.Client(pc, tlsConfig)

People today typically do something like this:
https://github.com/golang/build/blob/e12c9d226b16d4d335b515404895f626b6beee14/cmd/buildlet/reverse.go#L197

There are CLs open to add a package for this:
https://go-review.googlesource.com/c/net/+/111135
https://go-review.googlesource.com/c/net/+/37995
https://go-review.googlesource.com/c/net/+/134675

But that's only somewhat related to this issue.

@bradfitz

The code submitted only returns (and documents that it returns) net.Conn on a protocol upgrade (h2c, websockets, etc), but it never did so for CONNECT responses.

I think Response.Body on a protocol upgrade does not return net.Conn but just returns io.ReadWriteCloser.
I’ve confirmed that testTransportResponseBodyWritableOnProtocolSwitch failed if I changed https://github.com/golang/go/blob/master/src/net/http/transport_test.go#L5869 to rwc, ok := res.Body.(net.Conn).

I have a suggestion.
Before you start working on a CONNECT response, how about changing to return net.Conn on a protocol upgrade?

I guess on CONNECT, Response.Body should implement net.Conn interface because tls.Client need net.Conn.
It is a bit confusing to return net.Conn on a CONNECT and io.ReadWriteCloser on a protocol upgrade.

Furthermore, I think it is better to return net.Conn on a protocol upgrade in the first place because we can control read/write deadlines if we use net.Conn.

It seems like we just need to change readWriteCloserBody as follows

type readWriteCloserBody struct {
	_  incomparable
	br *bufio.Reader // used until empty
	net.Conn
}

I can work on the CL if you are OK.