@chobits
Let me explain what I observed.

I build this module from its master branch with Nginx 1.16.0.
the nginx configuration

server {
	    listen 443 ssl;
	    listen [::]:443 ssl;
	    server_name my.domain;
	    auth_basic "server auth";
	    auth_basic_user_file /etc/nginx/htpasswd;
	    ssl_certificate /etc/letsencrypt/live/my.domain/fullchain.pem;
	    ssl_certificate_key /etc/letsencrypt/live/my.domain/privkey.pem;
	    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
	    ssl_session_timeout 5m;
	    ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1;
	    ssl_prefer_server_ciphers on;
	    ssl_session_cache builtin:1000 shared:SSL:10m;
	    access_log on;
	    root         /var/www/html;
	    index index.html index.htm index.nginx-debian.html;

	    # dns resolver used by forward proxying
	    resolver                       8.8.8.8;

	    # forward proxy for CONNECT request
	    proxy_connect;
	    proxy_connect_allow            443 22;
	    proxy_connect_connect_timeout  10s;
	    proxy_connect_read_timeout     10s;
	    proxy_connect_send_timeout     10s;
	    
	    # forward proxy for non-CONNECT request
	    location / {
	        proxy_pass http://$host;
	        proxy_set_header Host $host;
	    }
	}

the test results for two use cases: one is forward proxying, another is tunnelling ssh traffic over https
3.1 curl

curl https://github.com/ -v -x my.domain:443 --proxy-user user01:password01
*   Trying 111.222.33.44...
* TCP_NODELAY set
* Connected to (nil) (111.222.33.44) port 443 (#0)
* Establish HTTP proxy tunnel to github.com:443
* Proxy auth using Basic with user 'user01'
> CONNECT github.com:443 HTTP/1.1
> Host: github.com:443
> Proxy-Authorization: Basic cHVuZ2lzemI6TEdtMzZCaXc5SlkwdTGFqNA==
> User-Agent: curl/7.52.1
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 400 Bad Request
< Server: nginx/1.16.0
< Date: Mon, 17 Jun 2019 07:44:24 GMT
< Content-Type: text/html
< Content-Length: 255
< Connection: close
<
* Received HTTP code 400 from proxy after CONNECT
* Curl_http_done: called premature == 0
* Closing connection 0

3.2 proxytunnel

proxytunnel -v -E -p my.domain:443 -P pungiszb:LGm36Biw9JY1Laj4 -d my.domain:22     # for testing only purpose, enable one proxy rather than two
SSL client to proxy enabled
Local proxy my.domain resolves to 111.222.33.44
Connected to my.domain:443 (local proxy)
Set SNI hostname to my.domain

Tunneling to my.domain:22 (destination)
Communication with local proxy:
 -> CONNECT my.domain:22 HTTP/1.1
 -> Host: my.domain:9443
 -> Proxy-Authorization: Basic cHVuZ2lzemI6TEdtMzZCaXc5SlkwdTGFqNA==
 -> Proxy-Connection: Keep-Alive
 <- HTTP/1.1 401 Unauthorized
HTTP return code: 401 Unauthorized
 <- Server: nginx/1.16.0
 <- Date: Mon, 17 Jun 2019 07:53:17 GMT
 <- Content-Type: text/html
 <- Content-Length: 179
 <- Connection: keep-alive
 <- WWW-Authenticate: Basic realm="server auth"

nginx debug log :

2019/06/17 15:58:29 [debug] 30468#30468: *50954 accept: 10.79.76.14:60038 fd:13
2019/06/17 15:58:29 [debug] 30468#30468: *50954 event timer add: 13: 60000:354427063
2019/06/17 15:58:29 [debug] 30468#30468: *50954 reusable connection: 1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 epoll add event: fd:13 op:1 ev:80002001
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http check ssl handshake
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http recv(): 1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 https ssl handshake: 0x16
2019/06/17 15:58:29 [debug] 30468#30468: *50954 tcp_nodelay
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL server name: "my.domain"
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL_do_handshake: -1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL_get_error: 2
2019/06/17 15:58:29 [debug] 30468#30468: *50954 reusable connection: 0
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL handshake handler: 0
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL_do_handshake: 1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL: TLSv1.2, cipher: "ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD"
2019/06/17 15:58:29 [debug] 30468#30468: *50954 reusable connection: 1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http wait request handler
2019/06/17 15:58:29 [debug] 30468#30468: *50954 malloc: 000055DA697591D0:1024
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL_read: -1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL_get_error: 2
2019/06/17 15:58:29 [debug] 30468#30468: *50954 free: 000055DA697591D0
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http wait request handler
2019/06/17 15:58:29 [debug] 30468#30468: *50954 malloc: 000055DA697591D0:1024
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL_read: 162
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL_read: -1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 SSL_get_error: 2
2019/06/17 15:58:29 [debug] 30468#30468: *50954 reusable connection: 0
2019/06/17 15:58:29 [debug] 30468#30468: *50954 posix_memalign: 000055DA6973B4B0:4096 @16
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http process request line
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http request line: "CONNECT my.domain:22 HTTP/1.1"
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http uri: ""
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http args: ""
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http exten: ""
2019/06/17 15:58:29 [debug] 30468#30468: *50954 posix_memalign: 000055DA6970C250:4096 @16
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http process request header line
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http header: "Host: my.domain:22"
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http header: "Proxy-Authorization: Basic  cHVuZ2lzemI6TEdtMzZCaXc5SlkwdTGFqNA=="
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http header: "Proxy-Connection: Keep-Alive"
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http header done
2019/06/17 15:58:29 [debug] 30468#30468: *50954 event timer del: 13: 354427063
2019/06/17 15:58:29 [debug] 30468#30468: *50954 generic phase: 0
2019/06/17 15:58:29 [debug] 30468#30468: *50954 generic phase: 1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 rewrite phase: 2
2019/06/17 15:58:29 [debug] 30468#30468: *50954 rewrite phase: 4
2019/06/17 15:58:29 [debug] 30468#30468: *50954 post rewrite phase: 5
2019/06/17 15:58:29 [debug] 30468#30468: *50954 generic phase: 6
2019/06/17 15:58:29 [debug] 30468#30468: *50954 generic phase: 7
2019/06/17 15:58:29 [debug] 30468#30468: *50954 generic phase: 8
2019/06/17 15:58:29 [debug] 30468#30468: *50954 generic phase: 9
2019/06/17 15:58:29 [debug] 30468#30468: *50954 access phase: 10
2019/06/17 15:58:29 [debug] 30468#30468: *50954 access phase: 11
2019/06/17 15:58:29 [info] 30468#30468: *50954 no user/password was provided for basic authentication, client: 10.79.76.14, server: my.domain, request: "CONNECT my.domain:22 HTTP/1.1", host: "my.domain:22"
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http finalize request: 401, "?" a:1, c:1
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http special response: 401, "?"
2019/06/17 15:58:29 [debug] 30468#30468: *50954 http set discard body
2019/06/17 15:58:29 [debug] 30468#30468: *50954 HTTP/1.1 401 Unauthorized
Server: nginx/1.16.0
Date: Mon, 17 Jun 2019 07:58:29 GMT
Content-Type: text/html
Content-Length: 179
Connection: keep-alive
WWW-Authenticate: Basic realm="server auth"

authorization for https connections? #42

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier! Saves Data!