elixir-mint / mint

88%

main: 88%

LAST BUILD ON BRANCH tunnel-target-identity

branch: tunnel-target-identity

CHANGE BRANCH

x

Reset

Sync Branches

• tunnel-target-identity
• al/1.18
• al/bump-ci
• al/ci
• al/client-settings
• al/deps
• al/elixir-1.10
• al/elixir-1.11+
• al/fix-leak
• al/fix-tests
• al/http2-logs
• al/improve-defguard
• al/modernize-ci
• al/stream-docs
• al/update-ci-versions
• al/updates
• allow-not-validating-target
• allow_302_for_twitter_integration_test
• andrea/code-coverage
• andrea/dialyzer
• andrea/fix-guard
• andrea/new-ci-versions
• chore/replace-deprecated-xref-exclude
• clamp-tunnel-timeout
• comp-time-optimization
• configurable-test-ports
• connect-tunnel-fixes
• connection-docs-ref
• contributing-and-testing-housekeeping
• docs-for-open
• dont-close-socket-on-recv-timeout
• ericmj/deprecate-read-write
• ericmj/fix-1xx-informational-response
• ericmj/http2-connection-window-size
• ericmj/http2-larger-default-windows
• ericmj/inet4-option
• ericmj/local-h2c-integration-tests
• ericmj/support-elixir-1.12
• ericmj/update-ubuntu
• fix-cannot-build-docker-image-using-podman-compose
• fix-dialyzer
• fix-http1-tests-not-tagged-correctly
• fix-incorrect-ci-badge
• fix-warnings
• fix/446-proxy-host-header
• fix/humize_error_code_custom_error
• http1-reason-phrase
• http2-connect-target
• https-tunnel-proxies
• ip-address-match-fun
• jv-default-store
• jv-elixir-1-19
• main
• next_body_chunk
• np/export-error-types
• optimize-http/2-request-creation
• patch-3
• preserve_header_case
• pvthuyen/add-support-for-cacerts-get
• refs/heads/main
• refs/pull/399/merge
• refs/pull/407/merge
• rewrite-contributing-and-testing-doc
• run-ci-against-erlang-27.1
• unnecessary-rst-stream-2
• unsafe-proxy-opts
• update-deps
• use_local_http_bin_in_all_tests
• whatyouhide/issue311
• wm-decompression
• wm-docker-compose
• wm-recv-response
• wrap-tunnel-errors

Build # 42605087fdb7cf6c4c71cadbfd7d4c2ea48a5ad7-PR-496

Build Type

Pull #496

github

Committed by ericmj

Commit Message

Fix hostname/address handling in tunnel proxies

Tunnel mode had the two halves of the documented contract inverted.
establish_proxy/2 built the CONNECT authority from the :hostname
override, so a pinned-IP address was never sent to the proxy and DNS
pinning silently stopped working through tunnels. upgrade_connection/3
then used the raw address as the TLS identity, so SNI, certificate
verification, and the post-tunnel Host header / HTTP/2 :authority all
used the address instead of the declared identity; with an :inet tuple
address (documented as supported) the upgrade raised in
String.to_charlist/1.

Now the CONNECT request targets the connection address (with :inet
tuples formatted via :inet.ntoa/1 and IPv6 addresses bracketed) while
the TLS upgrade uses the same identity resolution as direct
connections. The Host header of the CONNECT request is set to the
authority-form target as required by RFC 9112, section 3.2.3; it
previously named the proxy.

The pkix_test_data/1 helper duplicated in two test modules moved to a
shared Mint.TestCertificates support module.

Pull Request Pull Request #496: Fix hostname/address handling in tunnel proxies

Coverage Stats

13 of 14 new or added lines in 1 file covered. (92.86%)

8 existing lines in 1 file now uncovered.

1464 of 1666 relevant lines covered (87.88%)

495.75 hits per line