Simple Reverse Proxy Doesn't Work (HTTP/1.1 502 Bad Gateway)

[NiiightmareXD]

Hey, I tried making a very simple reverse proxy using pingora based on the examples but it does not work and every time I try to connect to it I get HTTP 502 with an error in the log saying "Fail to proxy: Upstream InvalidCert context: TLS connect() failed", can anyone help me?

Dependencies:

tokio = { version = "1.42.0", features = ["full"] }
async-trait = "0.1.84"

pingora = { version = "0.4.0", features = ["proxy", "openssl"] }

eyre = "0.6.12"
tracing = "0.1.41"
tracing-subscriber = "0.3.19"

Code:

use async_trait::async_trait;
use pingora::prelude::*;

use pingora::proxy::{ProxyHttp, Session};
use tracing::error;

#[tokio::main]
async fn main() {
    match server().await {
        Ok(()) => (),
        Err(e) => error!("Error: {e}"),
    }
}

pub struct ToobitProxy;

#[async_trait]
impl ProxyHttp for ToobitProxy {
    type CTX = ();
    fn new_ctx(&self) -> Self::CTX {}

    async fn upstream_peer(&self, _: &mut Session, _: &mut Self::CTX) -> Result<Box<HttpPeer>> {
        let peer = Box::new(HttpPeer::new(
            "1.1.1.1:443",
            true,
            "one.one.one.one".to_string(),
        ));

        Ok(peer)
    }

    async fn upstream_request_filter(
        &self,
        _session: &mut Session,
        upstream_request: &mut RequestHeader,
        _ctx: &mut Self::CTX,
    ) -> Result<()>
    where
        Self::CTX: Send + Sync,
    {
        upstream_request
            .insert_header("Host", "one.one.one.one")
            .unwrap();
        Ok(())
    }
}

async fn server() -> eyre::Result<()> {
    tracing_subscriber::fmt::init();

    let mut server = Server::new(None)?;
    server.bootstrap();

    let mut proxy = pingora::proxy::http_proxy_service(&server.configuration, ToobitProxy {});
    proxy.add_tcp("0.0.0.0:6191");

    server.add_service(proxy);
    server.run_forever();
}

OS:

Windows 11 24H2

Curl:

*   Trying 127.0.0.1:6191...
* Connected to 127.0.0.1 (127.0.0.1) port 6191
* using HTTP/1.x
> GET / HTTP/1.1
> Host: 127.0.0.1:6191
> User-Agent: curl/8.10.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 502 Bad Gateway
< Server: Pingora
< Date: Sat, 04 Jan 2025 18:16:18 GMT
< Content-Length: 0
< Cache-Control: private, no-store
< Connection: close
<
* shutting down connection #0

Log:

2025-01-04T18:23:34.010029Z  INFO pingora_core::server: Bootstrap starting    
2025-01-04T18:23:34.014258Z  INFO pingora_core::server: Server starting
2025-01-04T18:23:34.014654Z  INFO pingora_core::server: Graceful shutdown: grace period 300s starts
2025-01-04T18:23:37.124617Z ERROR pingora_proxy: Fail to proxy: Upstream InvalidCert context: TLS connect() failed: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl\statem\statem_clnt.c:2093:, SNI: one.one.one.one, status: 502, tries: 1, retry: false, GET /, Host: 127.0.0.1:6191

[bisho]

I am having the same issue.

I am able to route without HTTPS, to port 80, but the moment you use port 443 and SSL set to true in the HTTPPeer object it makes the proxy fail.

I don't even see the InvalidCert error (that must be what is happening here). This is what. Isee with trace:

[2025-04-07T20:09:55Z DEBUG pingora_proxy] Successfully get a new request
[2025-04-07T20:09:55Z TRACE pingora_proxy] Request header: Parts { method: GET, uri: /, version: HTTP/1.1, headers: {"host": "127.0.0.1:6188", "user-agent": "curl/8.7.1", "accept": "*/*"} }
[2025-04-07T20:09:55Z DEBUG pingora_core::connectors] No reusable connection found for addr: 1.1.1.1:443, scheme: HTTPS,sni: one.one.one.one,
[2025-04-07T20:09:55Z DEBUG pingora_core::connectors::l4] connected to new server: 1.1.1.1:443
[2025-04-07T20:09:55Z DEBUG pingora_core::protocols::l4::stream] Dropping socket BufStream { inner: BufReader { reader: BufWriter { writer: RawStreamWrapper { stream: Tcp(PollEvented { io: Some(TcpStream { addr: 192.168.50.110:54428, peer: 1.1.1.1:443, fd: 19 }) }), rx_ts: None }, buffer: 0/1460, written: 0 }, buffer: 0/65536 } }
[2025-04-07T20:09:55Z DEBUG pingora_proxy::proxy_h1] Sending header to upstream RequestHeader { base: Parts { method: GET, uri: /, version: HTTP/1.1, headers: {"host": "one.one.one.one", "user-agent": "curl/8.7.1", "accept": "*/*"} }, header_name_map: Some({"host": CaseHeaderName(b"Host"), "user-agent": CaseHeaderName(b"User-Agent"), "accept": CaseHeaderName(b"Accept")}), raw_path_fallback: [], send_end_stream: true }
[2025-04-07T20:09:55Z TRACE pingora_core::protocols::http::v1::client] Writing request header: b"GET / HTTP/1.1\r\nHost: one.one.one.one\r\nUser-Agent: curl/8.7.1\r\nAccept: */*\r\n\r\n"
[2025-04-07T20:09:55Z DEBUG pingora_proxy::proxy_h1] Read -1 bytes body from downstream
[2025-04-07T20:09:55Z DEBUG pingora_proxy::proxy_h1] finish sending body to upstream
[2025-04-07T20:09:55Z DEBUG pingora_proxy::proxy_h1] upstream event: Some(Failed(Error { etype: ConnectionClosed, esource: Upstream, retry: ReusedOnly, cause: None, context: Some(Owned("while reading response headers, bytes already read: 0")) }))
[2025-04-07T20:09:55Z DEBUG pingora_proxy::proxy_h1] upstream event now: None
[2025-04-07T20:09:55Z ERROR pingora_proxy] Fail to proxy: Upstream ConnectionClosed context: Peer: addr: 1.1.1.1:443, scheme: HTTPS,sni: one.one.one.one, cause:  context: while reading response headers, bytes already read: 0, status: 502, tries: 1, retry: false, GET /, Host: 127.0.0.1:6188

[bisho]

Found the issue, you need to add boringssl (or openssl, your preference) as feature in the Cargo.toml:

pingora = { version = "0.4", features = ["proxy", "lb", "boringssl"] }

[HuakunShen]

Hey, you saved my day! Wasted so much time on this.
Where did you find this?

I was trying to forward request to public domain names like e.g. jsonplaceholder.typicode.com
but couldn't do it.