elixir-mint / mint / d9e1824cf496eb6e616ae949c18ee8927d48b9bf

88%

Build Type

push

github

Committed by web-flow

Commit Message

Fix hostname/address handling in tunnel proxies (#496)

Tunnel mode had the two halves of the documented contract inverted.
establish_proxy/2 built the CONNECT authority from the :hostname
override, so a pinned-IP address was never sent to the proxy and DNS
pinning silently stopped working through tunnels. upgrade_connection/3
then used the raw address as the TLS identity, so SNI, certificate
verification, and the post-tunnel Host header / HTTP/2 :authority all
used the address instead of the declared identity; with an :inet tuple
address (documented as supported) the upgrade raised in
String.to_charlist/1.

Now the CONNECT request targets the connection address (with :inet
tuples formatted via :inet.ntoa/1 and IPv6 addresses bracketed) while
the TLS upgrade uses the same identity resolution as direct
connections. The Host header of the CONNECT request is set to the
authority-form target as required by RFC 9112, section 3.2.3; it
previously named the proxy.

The pkix_test_data/1 helper duplicated in two test modules moved to a
shared Mint.TestCertificates support module.

Coverage Stats

13 of 14 new or added lines in 1 file covered. (92.86%)

12 existing lines in 1 file now uncovered.

1465 of 1666 relevant lines covered (87.94%)

494.34 hits per line