Shopify / toxiproxy

:alarm_clock: :fire: A TCP proxy to simulate network and system conditions for chaos and resiliency testing
https://github.com/shopify/toxiproxy
MIT License
10.82k stars 449 forks source link

Allow configuration of upstream proxy #198

Open camelofcode opened 6 years ago

camelofcode commented 6 years ago

Been using Toxiproxy for a few months and it is helping out with a lot of my use cases.

It does have a limitation for me at the moment however. I am in a corporate network where all traffic must go through a proxy server before leaving the network. There doesn't seem to be any way to configure ToxiProxy to use this proxy, so I am unable to use toxics when accessing external resources. For us, this is the most useful case, as we can simulate conditions in our internal network already.

Can the functionality be added to allow the following chain:

client -> toxiproxy -> corporate proxy -> external service.

Currently my workaround is to use Fiddler, which will allow the configuration of an upstream proxy, and writing custom scripts to do basically what Toxiproxy does. It would be a lot better if I could just use Toxiproxy.

jpittis commented 6 years ago

Toxiproxy is "dumb" in that all it does is pass stream data from one port host pair to some upstream port host pair. I don't understand how your corporate proxy works but I assume something needs to tell it which external service to proxy to for a given connection. That sounds to me like a protocol built on top of TCP. We've been hesitant to add any Toxiproxy features that work with protocols above TCP. Partially due to added complexity and partially because there a wide range of features to support each of which a small portion of users require.

How does your corporate proxy work? How does it decide which external service to forward to?

camelofcode commented 6 years ago

It's just a standard web proxy, you still connect to the desired service endpoint - you just provide a proxy in the settings for whatever you are connecting with. I guess this is termed a 'gateway' or 'tunnelling proxy'. It sits in the DMZ and allows traffic from firewalled internal network to access the wider outside world.

Fiddler is probably the best example as it is both a proxy itself, and allows a gateway to be specified. It has a tab where you configure Fiddler AS a proxy (same as toxiproxy) image

But also a tab where you configure Fiddler to USE a proxy (what I want to do in toxiproxy) image

But pretty much any software I am using to connect to anything external allows specification of a proxy:

Configuring Chrome/Internet Explorer to connect to outside world via proxy image

Configuring Filezilla to connect to outside world via proxy image

Configuring PuTTY to connect to the outside world via a proxy image

Or on Linux when using wget, I have to configure a proxy to connect to outside like: wget {external url} -e use_proxy=yes -e http_proxy=127.0.0.1:8080

I've also had to set the same thing up on various software packages on windows and linux servers to allow them to call to the outside world - Git, Jenkins, Octopus Deploy etc.

I've worked in numerous companies over the years, and any company I ever worked in larger than about 100 people had the same enforcement - no access to external networks except via proxy. And every other tool I use, on Windows or Linux supports this.

I'm afraid I don't know Go at all but the web clients in .NET, Java, Node.js, Python that I have used allow specification of a proxy when setting up a connection, so I've never had any problem with this when developing my own code here.

jpittis commented 6 years ago

The trouble is that Toxiproxy isn't a "web proxy". It only understands TCP. I don't think we plan on adding any HTTP support any time soon.