Re: HTTPS Proxy Support

Rodrigo Arias <rodarima-Re5JQEeQqe8AvxtiuMwx3w-XMD5yJDbdMReXY1tMh2IBg@public.gmane.org> wrote:
> On Wed, Jun 19, 2024 at 01:15:52PM +1000, Kevin Koster wrote:
>>As mentioned in the discussion about link handlers and webpage
>>content rewriting, I once looked into using Web proxy software to
>>do the latter. One complication was that Dillo doesn't support
>>a feature equivalent to setting the https_proxy environment
>>variable for GNU Wget, whereby the proxy acts as the HTTPS
>>endpoint for encrypted Web server connections and sends the data
>>back to the browser unencrypted. This allows the proxy to
>>manipulate page content without needing to transform HTTP requests
>>into HTTPS requests and rewrite https:// in page URLs as http://.
> 
> This should be easy to do, as Dillo can forward the http_proxy variable 
> to the wget command.
> 
> However, if you start Dillo from a shell where the http_proxy variable 
> is set in the environment, I would imagine it would be already picked by 
> Dillo and the internal wget command. The dpid daemon has to start from 
> this shell, so you should do a "dpidc stop" command before to ensure it.

I'm not sure if we're on the same page, Wget supports http_proxy
and https_proxy environment variables. The former may or may not
tunnel HTTPS requests through a Web proxy, but that's not what I
want since then the proxy can't manipulate the data and the client
needs to handle the encryption. https_proxy with Wget uses the
proxy to do all the encryption and therefore those issues don't
apply. More browsers support the HTTPS tunneling proxy feature,
but that doesn't achieve anything that I'm interested in
personally.

Anyway Wget https_proxy is only a common example of the feature
(which is described in more detail at the blog link), I'm not so
much interested in using it when Dillo launches Wget for downloads,
but for data retrieved by Dillo itself to display within the
browser.

>>Besides proxies, for old computers where performance or available
>>TLS library versions prevent using modern encryption, this also
>>allows the encrypted communications to be offloaded to more modern
>>computer. Or using a different encryption library that's optimised
>>for old computers, as described here:
>>
>>http://oldvcr.blogspot.com/2020/11/fun-with-crypto-ancienne-tls-for.html
>>
>>For using this with old computers, it would be ideal if the HTTPS
>>proxy feature was available even if Dillo is compiled without
>>linking to a TLS library. Also the https_proxy environment variable
>>should be set to the HTTPS proxy hostname when running Wget for
>>downloads so that it applies to those as well.
> 
> Sounds doable, but I would have to review how the HTTPS traffic is 
> handled in Dillo when a proxy is present.

I did look into this with Dillo 3.0.5 and I'm confident this
HTTPS proxy feature wasn't supported already there, but I never
worked out exactly where the feature would fit into that code
(which is likely quite different now anyway since moving out of
the DPI environment).
_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]