elixir-mint / mint / 42605087fdb7cf6c4c71cadbfd7d4c2ea48a5ad7-PR-496

88%

main: 88%

Pull #496

github

Fix hostname/address handling in tunnel proxies

Tunnel mode had the two halves of the documented contract inverted.
establish_proxy/2 built the CONNECT authority from the :hostname
override, so a pinned-IP address was never sent to the proxy and DNS
pinning silently stopped working through tunnels. upgrade_connection/3
then used the raw address as the TLS identity, so SNI, certificate
verification, and the post-tunnel Host header / HTTP/2 :authority all
used the address instead of the declared identity; with an :inet tuple
address (documented as supported) the upgrade raised in
String.to_charlist/1.

Now the CONNECT request targets the connection address (with :inet
tuples formatted via :inet.ntoa/1 and IPv6 addresses bracketed) while
the TLS upgrade uses the same identity resolution as direct
connections. The Host header of the CONNECT request is set to the
authority-form target as required by RFC 9112, section 3.2.3; it
previously named the proxy.

The pkix_test_data/1 helper duplicated in two test modules moved to a
shared Mint.TestCertificates support module.

13 of 14 new or added lines in 1 file covered. (92.86%)

1464 of 1666 relevant lines covered (87.88%)

495.75 hits per line