fix(proxy): refuse tunneling non-HTTP protocols through HTTP proxy#120
Merged
jonwiggins merged 2 commits intomainfrom Mar 28, 2026
Merged
Conversation
When --proxytunnel (-p) is set with an HTTP proxy, all protocols must attempt a CONNECT tunnel through the proxy before protocol-specific handling. Previously, non-HTTP protocols either failed with URL parse errors (missing default ports) or were rejected as unsupported before reaching the proxy tunnel logic. Changes: - Add default ports for dict, imap, imaps, mqtt, mqtts, pop3, pop3s, smtp, smtps, and telnet in Url::port_or_default() - Add CONNECT tunnel pre-check in do_single_request() for protocols that don't handle their own tunneling (e.g. gopher, dict, telnet, rtsp, ldap, smb, sftp, scp, mqtt, ws) - Add is_http_proxy_tunnel() getter on Easy for CLI scheme validation - Bypass early scheme validation in CLI when proxy tunnel is active - Add gopher, rtsp, ldap, smb to the supported protocol list Passes curl test 445 (Refuse tunneling protocols through HTTP proxy). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add CONNECT tunnel handling for RTSP in the early dispatch path (RTSP bypasses do_single_request, so the generic tunnel code didn't run for it) - Remove FTPS from the already_handles_tunnel exclusion list so the generic CONNECT tunnel code handles proxy rejection for FTPS URLs All protocols now correctly attempt CONNECT tunnel when -p is active with an HTTP proxy, matching curl's behavior. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
-p(proxytunnel) is active with an HTTP proxy, all protocols now attempt a CONNECT tunnel through the proxy before protocol-specific handling, matching curl's behavioris_http_proxy_tunnel()accessor onEasyfor CLI tunnel-bypass logicdo_single_request)Test plan
cargo fmt,cargo clippy,cargo testall pass🤖 Generated with Claude Code