http-proxy does not allow to connect ho https-proxy
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
Currently openvpn --http-proxy option only allows a HTTP proxy, i.e. it directly issues the CONNECT command to http proxy. There is no option to connect to a HTTP proxy not directly, but via TLS/SSL, a so called https-proxy option, a regular HTTP proxy behind TLS/SSL, it is rather easy to setup such with apache or nginx. This suggested --http-proxy-over-TLS option has three very important benefits:
- A local ISP cannot be able to eavesdrop the IP of actual VPN server during CONNECT phase and block connection proactively.
- Most important. Currently OpenVPN is frequently blocked/throttled by some ISPs. This option would allow to pass ISP blocking. A OpenVPN connection with http-proxy option currently gets blocked by ISP with exactly the same logic as used when it is connected directly. If OpenVPN connection would be encapsulated in HTTPS connection to the proxy -- it would be much more difficult to identify and block such a connection.
- A proxy often has basic type of authorization credentials. A connection to such proxy without SSL leaks proxy auth credentials.
This is a request for improvement. Tested on openvpn-2.6.12 and earlier, none support a HTTP proxy over TLS/SSL. This improvement feature is easy to implement and it does not affect other OpenVPN functionality.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the --http-proxy entry point and the existing CONNECT handling. Review how TLS/SSL connections are established before defining the HTTPS-proxy flow and its proxy authentication behavior. Done means OpenVPN can connect through an HTTP proxy over TLS without changing direct HTTP-proxy behavior, with coverage for the new option.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100