2004918 - Add nsIProxyInfo::ALWAYS_TUNNEL_VIA_PROXY to force HTTP CONNECT

Status: ASSIGNED

(Core :: Networking: HTTP, defect, P2)

Description

[Kershaw Chang [:kershaw]]

I ran into this while testing IPProtection against a plain HTTP site. With the proxyInfo created by IPProtection, necko does not use HTTP CONNECT for plain HTTP; instead it sends a direct GET to the proxy, which responds with 403 Forbidden.

Right now, when creating a new proxyInfo, there’s no way to set the nsIProtocolProxyService::RESOLVE_ALWAYS_TUNNEL flag. We need a way to construct proxyInfo that always uses HTTP CONNECT (i.e., force tunneling), even for plain HTTP.

Comment 1

[Kershaw Chang [:kershaw]]

Attachment: Bug 2004918 - Add nsIProxyInfo::ALWAYS_TUNNEL_VIA_PROXY flag, r=#necko,sstreich

Comment 2

[Kershaw Chang [:kershaw]]

Attachment: Bug 2004918 - Allow to set a proxy info that always uses HTTP CONNECT r=#necko,robwu

Comment 3

[Kershaw Chang [:kershaw]]

Attachment: Bug 2004918 - Remove nsHttpConnection::RequestDone to prevent premature H2 tunnel close, r=#necko

Previously we set mRequestDone = true right after writing the HTTP request. That state propagated to Http2StreamTunnel::mSendClosed, and in Http2StreamBase::ReadSegments the stream was got closed.
As a result, an HTTP/2 tunnel could be closed immediately after sending the request bytes, failing to receive the response.