Skip to content

fix: ALPN missed when using socks5 proxy with rustls backend#2164

Merged
seanmonstar merged 1 commit intoseanmonstar:masterfrom
cxw620:patch-alpn
Mar 24, 2024
Merged

fix: ALPN missed when using socks5 proxy with rustls backend#2164
seanmonstar merged 1 commit intoseanmonstar:masterfrom
cxw620:patch-alpn

Conversation

@cxw620
Copy link
Copy Markdown
Contributor

@cxw620 cxw620 commented Mar 9, 2024

reopen PR, fix #2118

@cxw620
Copy link
Copy Markdown
Contributor Author

cxw620 commented Mar 11, 2024

I've tested this PR and it's working well. Would you mind taking a look at it? Thanks!

@cxw620
Copy link
Copy Markdown
Contributor Author

cxw620 commented Mar 22, 2024

@seanmonstar Could you provide an update on this PR? Any feedback or comments on it? Thanks :D

Comment thread src/connect.rs
use tokio_rustls::TlsConnector as RustlsConnector;

let tls = tls_proxy.clone();
let tls = tls.clone();
Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this still use the proxy TLS? Should the fix instead be that we set ALPN on the proxy TLS?

Copy link
Copy Markdown
Contributor Author

@cxw620 cxw620 Mar 23, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can see when connect_via_proxy and ProxyScheme::Socks5, we call self.connect_socks(dst, proxy_scheme).await, dst is our target.

            #[cfg(feature = "__rustls")]
            Inner::RustlsTls { tls, .. } => {
                if dst.scheme() == Some(&Scheme::HTTPS) {
                    use std::convert::TryFrom;
                    use tokio_rustls::TlsConnector as RustlsConnector;

                    let tls = tls.clone();
                    let host = dst.host().ok_or("no host in url")?.to_string();
                    let conn = socks::connect(proxy, dst, dns).await?; // create proxy tunnel through socks server and connect to dst.
                    let conn = TokioIo::new(conn);
                    let conn = TokioIo::new(conn);
                    let server_name =
                        rustls_pki_types::ServerName::try_from(host.as_str().to_owned())
                            .map_err(|_| "Invalid Server Name")?;
                    let io = RustlsConnector::from(tls) // here we create TLS connector for HTTPS through socks tunnel, so `tls` should not be proxy TLS.
                        .connect(server_name, conn)
                        .await?;
                    let io = TokioIo::new(io);
                    return Ok(Conn {
                        inner: self.verbose.wrap(RustlsTlsConn { inner: io }),
                        is_proxy: false,
                        tls_info: false,
                    });
                }
            }

@seanmonstar seanmonstar merged commit fff307b into seanmonstar:master Mar 24, 2024
@cxw620 cxw620 deleted the patch-alpn branch May 9, 2024 11:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Not sending ALPN when using socks5 proxy

2 participants