This commit is contained in:
Haoyu Qiu 2024-11-21 09:03:16 +08:00 committed by GitHub
commit f668b8e0cd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -1430,6 +1430,7 @@ pub fn connectTunnel(
proxy: *Proxy,
tunnel_host: []const u8,
tunnel_port: u16,
tunnel_protocol: Connection.Protocol,
) !*Connection {
if (!proxy.supports_connect) return error.TunnelNotSupported;
@ -1440,6 +1441,9 @@ pub fn connectTunnel(
})) |node|
return node;
if (disable_tls and tunnel_protocol == .tls)
return error.TlsInitializationFailed;
var maybe_valid = false;
(tunnel: {
const conn = try client.connectTcp(proxy.host, proxy.port, proxy.protocol);
@ -1481,8 +1485,21 @@ pub fn connectTunnel(
errdefer client.allocator.free(conn.host);
conn.port = tunnel_port;
conn.protocol = tunnel_protocol;
conn.closing = false;
if (tunnel_protocol == .tls) {
if (disable_tls) unreachable;
conn.tls_client = try client.allocator.create(std.crypto.tls.Client);
errdefer client.allocator.destroy(conn.tls_client);
conn.tls_client.* = std.crypto.tls.Client.init(conn.stream, client.ca_bundle, tunnel_host) catch return error.TlsInitializationFailed;
// This is appropriate for HTTPS because the HTTP headers contain
// the content length which is used to detect truncation attacks.
conn.tls_client.allow_truncation_attacks = true;
}
return conn;
}) catch {
// something went wrong with the tunnel
@ -1520,7 +1537,7 @@ pub fn connect(
}
if (proxy.supports_connect) tunnel: {
return connectTunnel(client, proxy, host, port) catch |err| switch (err) {
return connectTunnel(client, proxy, host, port, protocol) catch |err| switch (err) {
error.TunnelNotSupported => break :tunnel,
else => |e| return e,
};