[gtoxlili]

shakeHandContext reads the CONNECT response through a bufio.Reader and then drops the reader. If the proxy writes the target's first bytes right behind its 200 response, they can arrive in the same read and stay in the dropped buffer. Server-first protocols such as SSH or SMTP then lose their banner and the connection hangs.

The reader is now created in StreamConnContext and passed to the handshake. N.WarpConnWithBioReader puts the buffered bytes in front of the returned connection, and returns the connection unchanged when nothing is buffered.

To reproduce, put an HTTP proxy outbound in front of a server that speaks first, and have the proxy send HTTP/1.1 200 Connection established\r\n\r\n and the server's first bytes in one write. The client never receives those bytes.