Re: HTTPS Proxy Support

Rodrigo Arias <rodarima-Re5JQEeQqe8AvxtiuMwx3w-XMD5yJDbdMReXY1tMh2IBg@public.gmane.org> wrote:
> On Thu, Jun 20, 2024 at 04:07:27PM +1000, Kevin Koster wrote:
>>My content-modifying proxy application might be very niche, but I still
>>think it would be more widely useful for people running Dillo on very
>>old computers. Let me know whether it's something that might be accepted
>>for Dillo even if I decide to try implementing it myself.
> 
> Provided that those machines cannot deal with HTTPS traffic, I think is 
> a reasonable use case. I haven't had time to dig a bit more into this 
> issue to see if there is a way to make those old machines use TLS 
> instead

Oh there is, the Crypto Ancienne TLS library is designed for this:
https://github.com/classilla/cryanc

I started work on supporting it for HTTPS in Dillo, and got far
enough that I'm sure the library would work for it, though I didn't
finish debugging my attempt. That was while Dillo 3.1 looked
abandoned so I did it as a HTTPS DPI plug-in, which makes my work
obsolete now.

But the proxy approach allows old versions/binaries to keep working
too. If Dillo 3.0.5 had supported it, then the HTTPS issues from
lacking SNI support could have been worked around by running an
'old-style' HTTPS proxy with SNI support on localhost.

> I won't oppose to it, but we probably want to ensure that we don't send 
> plain traffic to a proxy when browsing HTTPS pages by accident. We 
> should add an option like "allow_insecure_proxy" (false by default) or 
> similar, so it is harder to leak HTTPS traffic accidentally.

Sure, or actually I'd suggest using a separate variable/option name
to set that proxy server because using "https_proxy" for both proxy
systems is what's already confused me now with Wget. Something
like "https_endpoint=[hostname]" maybe?
_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]