add option to send host header in HTTP proxy CONNECT command

ChangeLog

@@ -1,6 +1,7 @@
 
 2.0.11 not released
 
+ * add option to send host header in HTTP proxy CONNECT command
  * assume copy_file_range() exists on linux (unless old glibc)
  * fix issue where set_piece_deadline() did not correctly post read_piece_alert
  * fix integer overflow in piece picker

include/libtorrent/aux_/proxy_settings.hpp

@@ -86,6 +86,10 @@ namespace aux {
 
  // if true, tracker connections are subject to the proxy settings
  bool proxy_tracker_connections = true;
+
+ // when proxying non plain HTTP over an HTTP proxy (SSL or peer
+ // connections), also tell the proxy which hostname we're connecting to
+ bool send_host_in_connect = false;
  };
 
 }}

include/libtorrent/http_stream.hpp

@@ -60,21 +60,21 @@ class http_stream : public proxy_base
  m_password = password;
  }
 
- void set_dst_name(std::string const& host)
+ void set_host(std::string const& host)
  {
- m_dst_name = host;
+ m_host = host;
  }
 
  void close(error_code& ec)
  {
- m_dst_name.clear();
+ m_host.clear();
  proxy_base::close(ec);
  }
 
 #ifndef BOOST_NO_EXCEPTIONS
  void close()
  {
- m_dst_name.clear();
+ m_host.clear();
  proxy_base::close();
  }
 #endif
@@ -129,6 +129,10 @@ class http_stream : public proxy_base
  std::back_insert_iterator<std::vector<char>> p(m_buffer);
  std::string const endpoint = print_endpoint(m_remote_endpoint);
  write_string("CONNECT " + endpoint + " HTTP/1.0\r\n", p);
+ if (!m_host.empty())
+ {
+ write_string("Host: " + m_host + "\r\n", p);
+ }
  if (!m_user.empty())
  {
  write_string("Proxy-Authorization: Basic " + base64encode(
@@ -218,7 +222,7 @@ class http_stream : public proxy_base
  // proxy authentication
  std::string m_user;
  std::string m_password;
- std::string m_dst_name;
+ std::string m_host;
 
  // this is true if the connection is HTTP based and
  // want to talk directly to the proxy

include/libtorrent/settings_pack.hpp

@@ -1014,6 +1014,14 @@ namespace aux {
  // protocol may not be valid from the proxy's point of view.
  socks5_udp_send_local_ep,
 
+ // When using HTTP proxy (in proxy_type), libtorrent will connect
+ // to peers and trackers using the `CONNECT` proxy command. In this
+ // command it's possible to reveal the hostname of the server we're
+ // connecting to. When this option is true, the hostname will be
+ // sent. This feature can be useful if the proxy is used to
+ // man-in-the-middle connections.
+ proxy_send_host_in_connect,
+
  max_bool_setting_internal
  };
 

simulation/test_http_connection.cpp

@@ -270,7 +270,7 @@ void run_suite(lt::aux::proxy_settings ps)
  // the try-next test in his case would test the socks proxy itself, whether
  // it has robust retry behavior (which the simple test proxy that comes with
  // libsimulator doesn't).
- if (ps.proxy_hostnames == false)
+ if (ps.type != settings_pack::socks5 && ps.proxy_hostnames == false)
  {
  // this hostname will resolve to multiple IPs, all but one that we cannot
  // connect to and the second one where we'll get the test file response. Make
@@ -600,9 +600,7 @@ TORRENT_TEST(http_connection_http_error)
  test_proxy_failure(settings_pack::http);
 }
 
-// Requests a proxied SSL connection. This test just ensures that the correct CONNECT request
-// is sent to the proxy server.
-TORRENT_TEST(http_connection_ssl_proxy)
+void test_connection_ssl_proxy(bool const with_hostname)
 {
  using sim::asio::ip::address_v4;
  sim_config network_cfg;
@@ -615,15 +613,24 @@ TORRENT_TEST(http_connection_ssl_proxy)
  sim::http_server http_proxy(proxy_ios, 4445);
 
  lt::aux::proxy_settings ps = make_proxy_settings(settings_pack::http);
+ ps.send_host_in_connect = with_hostname;
 
  int client_counter = 0;
  int proxy_counter = 0;
 
  http_proxy.register_handler("10.0.0.2:8080"
- , [&proxy_counter](std::string method, std::string req, std::map<std::string, std::string>&)
+ , [&proxy_counter, with_hostname](std::string method, std::string req, std::map<std::string, std::string>& headers)
  {
  proxy_counter++;
  TEST_EQUAL(method, "CONNECT");
+ if (with_hostname)
+ {
+ TEST_EQUAL(headers["host"], "10.0.0.2");
+ }
+ else
+ {
+ TEST_CHECK(headers.empty());
+ }
  return sim::send_response(403, "Not supported", 1337);
  });
 
@@ -656,6 +663,19 @@ TORRENT_TEST(http_connection_ssl_proxy)
  TEST_EQUAL(proxy_counter, 1);
 }
 
+// Requests a proxied SSL connection. This test just ensures that the correct CONNECT request
+// is sent to the proxy server.
+TORRENT_TEST(http_connection_ssl_proxy_no_hostname)
+{
+ test_connection_ssl_proxy(false);
+}
+
+TORRENT_TEST(http_connection_ssl_proxy_hostname)
+{
+ test_connection_ssl_proxy(true);
+}
+
+
 // TODO: test http proxy with password
 // TODO: test socks5 with password
 // TODO: test SSL

src/http_connection.cpp

@@ -588,6 +588,12 @@ void http_connection::connect()
  }
  }
 
+ if (m_proxy.send_host_in_connect
+ && boost::get<http_stream>(&*m_sock))
+ {
+ boost::get<http_stream>(*m_sock).set_host(m_hostname);
+ }
+
  TORRENT_ASSERT(m_next_ep < int(m_endpoints.size()));
  if (m_next_ep >= int(m_endpoints.size())) return;
 

src/proxy_settings.cpp

@@ -51,6 +51,8 @@ void init(proxy_settings& p, Settings const& sett)
  settings_pack::proxy_peer_connections);
  p.proxy_tracker_connections = sett.get_bool(
  settings_pack::proxy_tracker_connections);
+ p.send_host_in_connect = sett.get_bool(
+ settings_pack::proxy_send_host_in_connect);
 }
 
 }

src/settings_pack.cpp

@@ -239,6 +239,7 @@ constexpr int DISK_WRITE_MODE = settings_pack::enable_os_cache;
  SET(allow_idna, false, nullptr),
  SET(enable_set_file_valid_data, false, nullptr),
  SET(socks5_udp_send_local_ep, false, nullptr),
+ SET(proxy_send_host_in_connect, false, nullptr),
  }});
 
  CONSTEXPR_SETTINGS

src/torrent.cpp

@@ -6722,6 +6722,13 @@ namespace {
  bool const proxy_hostnames = settings().get_bool(settings_pack::proxy_hostnames)
  && !is_ip;
 
+ if (!is_ip
+ && settings().get_bool(settings_pack::proxy_send_host_in_connect)
+ && boost::get<http_stream>(&s))
+ {
+ boost::get<http_stream>(s).set_host(hostname);
+ }
+
  if (proxy_hostnames
  && (boost::get<socks5_stream>(&s)
 #if TORRENT_USE_SSL