OpenVPN / OpenVPN/openvpn

Bug in Host: name for proxy directive

Open
#635 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

While working on issue #633 while testing via the stunnel I found a bug in proxy connect code.

With the settings

remote 1.1.1.1 1194
http-proxy proxy.server.name.from.config.com 8080 auto

I see in openvpn client log:

Oct 27 08:19:07 XXXXX openvpn[944495]: Send to HTTP proxy: 'CONNECT 1.1.1.1:1194 HTTP/1.0'
Oct 27 08:19:07 XXXXX openvpn[944495]: Send to HTTP proxy: 'Host: 1.1.1.1'

openvpn client uses the values of "remote" field both for CONNECT and for Host: value.
This is incorrect. The Host: field is used on the proxy server for SNI for selecting
apache virtual server used for http proxy. The value of the Host: field should be the name(or ip adderss) as proxy host name.
I think the proper values of host is the the one from http-proxy value:

'CONNECT 1.1.1.1:1194 HTTP/1.0'
'Host: proxy.server.name.from.config.com'

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the proxy connect code that handles the http-proxy and remote settings, then reproduce the configuration shown in the issue and inspect the client log. Done means the CONNECT line still targets the remote address and port, while the Host header uses the proxy hostname from the http-proxy setting.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.