Add option to hide "Via" header

Partially implements #8.

README.md

@@ -36,6 +36,11 @@ If set, forwardproxy will not add user's IP to "Forwarded:" header.
 WARNING: there are other side-channels in your browser, that you might want to eliminate, such as WebRTC, see [here](https://www.ivpn.net/knowledgebase/158/My-IP-is-being-leaked-by-WebRTC-How-do-I-disable-it.html) how to disable it.  
 _Default: no hiding; `Forwarded: for="useraddress"` will be sent out._
 
+- **hide_via**  
+If set, forwardproxy will not add Via header, and prevents simple way to detect proxy usage.  
+WARNING: there are other side-channels to determine this.  
+_Default: no hiding; Header in form of `Via: 2.0 caddy` will be sent out._
+
 - **probe_resistance [secretlink.tld]**  
 EXPERIMENTAL. (Here be dragons!) Attempts to hide the fact that the site is a forward proxy. Proxy will no longer respond with "407 Proxy Authentication Required" if credentials are incorrect or absent, and will attempt to mimic a generic Caddy web server as if the forward proxy is not configured. Since not all clients (browsers, operating systems, etc.) are able to be configured to send credentials right away (some only authenticate after receiving a 407), we will use a secret link. Make sure that specified domain name is visitable, does not contain uppercase characters, does not start with dot, etc. Only this address will trigger a 407 response, prompting browsers to request credentials from users and cache them for the rest of the session. It is possible to use any top level domain (tld), but for secrecy reasons it is highly recommended to use `.localhost`. Probing resistance works (and makes sense) only if basicauth is set up. To use your proxy with probe resistance, supply your basicauth credentials to your client configuration if possible. If your proxy client does not authenticate right away, you may then have to visit your secret link in your browser to trigger the authentication.  
 _Default: no probing resistance._

forwardproxy.go

@@ -37,6 +37,7 @@ type ForwardProxy struct {
 	authRequired       bool
 	authCredentials    [][]byte // slice with base64-encoded credentials
 	hideIP             bool
+	hideVia            bool
 	whitelistedPorts   []int
 	probeResistDomain  string
 	pacFilePath        string
@@ -352,7 +353,9 @@ func (fp *ForwardProxy) generateForwardRequest(inReq *http.Request) (*http.Reque
 	}
 
 	// https://tools.ietf.org/html/rfc7230#section-5.7.1
-	outReq.Header.Add("Via", strconv.Itoa(inReq.ProtoMajor)+"."+strconv.Itoa(inReq.ProtoMinor)+" caddy")
+	if !fp.hideVia {
+		outReq.Header.Add("Via", strconv.Itoa(inReq.ProtoMajor) + "." + strconv.Itoa(inReq.ProtoMinor) + " caddy")
+	}
 	return outReq, nil
 }
 

setup.go

@@ -94,6 +94,11 @@ func setup(c *caddy.Controller) error {
 				return c.ArgErr()
 			}
 			fp.hideIP = true
+		case "hide_via":
+			if len(args) != 0 {
+				return c.ArgErr()
+			}
+			fp.hideVia = true
 		case "probe_resistance":
 			if len(args) > 1 {
 				return c.ArgErr()

setup_test.go

@@ -84,6 +84,10 @@ func TestSetup(t *testing.T) {
 	testParsing([]string{"hide_ip 0"}, false)
 	testParsing([]string{"hide_ip 0 1"}, false)
 
+	testParsing([]string{"hide_via"}, true)
+	testParsing([]string{"hide_via 0"}, false)
+	testParsing([]string{"hide_via 0 1"}, false)
+
 	testParsing([]string{"probe_resistance"}, false)
 	testParsing([]string{"probe_resistance local.host"}, false)
 	testParsing([]string{"probe_resistance local.host very.local.host"}, false)