search

szmarczak / http2-wrapper

Use HTTP/2 the same way like HTTP/1
MIT License
239 stars 18 forks source link

ALPN negotiation leaks real IP address when using proxy #74

Closed szmarczak closed 3 years ago

szmarczak commented 3 years ago

Should be fixed inside resolve-alpn:

https://github.com/szmarczak/resolve-alpn/blob/43a065f747bc32728af4e2529d1ee5a61a29c63e/index.js#L29

/cc @mnmkng

szmarczak commented 3 years ago

I'll try to fix it now.

szmarczak commented 3 years ago

https://github.com/szmarczak/resolve-alpn/commit/c272583d14854cbea14bfe0a57aef3391752ed1d should make this possible. But this still needs to be adressed in http2-wrapper.

The resolve-alpn is going to accept a second argument which can be an asynchronous function that returns a TLSSocket. So this allows us to support options.createConnection. However, I'm still wondering how to solve the Agent use case. Some Agents don't expose agent.createConnection but only agent.addRequest(request, options) like in https://github.com/nodejs/undici/pull/887#issuecomment-882141837

So the solution would be to http.request with a CONNECT method. But http2-wrapper has no knowledge if the Agent is a proxy or not. So the solution still remains to do the ALPN negotiation on your own and update the options.request accordingly.

I'll update the README.

szmarczak commented 3 years ago

With http2-wrapper@2.0.9 it's now possible to do ALPN negotiation via proxy:

https://github.com/szmarczak/http2-wrapper/blob/master/examples/proxies/alpn-negotiation.js

(remember to destroy the tlsSocket if the protocol is all you need)

but this still requires custom logic in the Got instance.