Cannot use an https_proxy

[silentcreek]

Hi,

I have tried owut (again) and I couldn't get it to work with an https_proxy. You can make opkg use an https_proxy if you install an http client that supports it, like wget-ssl, and set the evironment variable https_proxy accordingly. I've tried the same with owut (and previously auc) and it doesn't work, unfortunately.

Is there a way to let owut use an https_proxy as well?

Thanks!

[efahl]

It looks like there's support in the uclient library (https://github.com/openwrt/uclient/blob/master/ucode.c#L536) so we should be able to make this work.

Can you give me (lots of) details of how you set this up and how you'd expect it to work? Maybe an example of how you'd do it with uclient-fetch and its --proxy=on parameter?

[efahl]

Hmm, this might be easier than I thought. Here's the code in question:

https://github.com/efahl/owut/blob/main/files/owut#L437

Could you edit your installed /usr/bin/owut, search for the set_url line (should be about line 437) and replace it with this? Of course that https://my.proxy should be changed to your actual proxy.

                        "  one of the ca-bundle or ca-certificates packages.\n");
                }
        }

// Everything below this line is the change
//      _uc_uc.set_url(url);  <<< original code we're replacing
        let proxy_url = "https://my.proxy";  // really a getenv, but for testing...
        if (proxy_url) {
                L.log(2, "Using proxy_url '%s'\n", proxy_url);
                _uc_uc.set_url(proxy_url);
                _uc_uc.set_proxy_url(url);
        }
        else {
                _uc_uc.set_url(url);
        }
// And above this line
        _uc_cb.url      = url;
        _uc_cb.dst_file = dst_file;

If that works, then we're basically done, just need to hook it to a getenv("https_proxy") (or http_proxy depending on url), and clean it all up.

[silentcreek]

It looks like there's support in the uclient library (https://github.com/openwrt/uclient/blob/master/ucode.c#L536) so we should be able to make this work.

Can you give me (lots of) details of how you set this up and how you'd expect it to work? Maybe an example of how you'd do it with uclient-fetch and its --proxy=on parameter?

I don't use uclient-fetch, but wget-ssl. opkg uses wget automatically, if installed. The thing with uclient-fetch is that it does not seem to support the CONNECT method to establish an HTTPS conenction over an HTTP proxy, but wget-ssl does.

So, for okpg to make this work, is very simple. Install wget-ssl, ensure the package feeds URLs are set to https://... and not http://... and have the environment variable https_proxy point to your proxy, which in my case looks like this:
https_proxy=http://proxy.lan.mydomain.tld:8443/

With uclient-fetch, this only "kinda" works, but not really. So, what happens with uclient-fetch when "https_proxy" contains a URL that starts with "http://" is, that it will use the proxy, but then establish a connection over HTTP (port 80) and not HTTPS (port 443) (by that I mean the connection between the proxy and the webserver)..

[silentcreek]

Hmm, this might be easier than I thought. Here's the code in question:

https://github.com/efahl/owut/blob/main/files/owut#L437

Could you edit your installed /usr/bin/owut, search for the set_url line (should be about line 437) and replace it with this? Of course that https://my.proxy should be changed to your actual proxy.

                        "  one of the ca-bundle or ca-certificates packages.\n");
                }
        }

// Everything below this line is the change
//      _uc_uc.set_url(url);  <<< original code we're replacing
        let proxy_url = "https://my.proxy";  // really a getenv, but for testing...
        if (proxy_url) {
                L.log(2, "Using proxy_url '%s'\n", proxy_url);
                _uc_uc.set_url(proxy_url);
                _uc_uc.set_proxy_url(url);
        }
        else {
                _uc_uc.set_url(url);
        }
// And above this line
        _uc_cb.url      = url;
        _uc_cb.dst_file = dst_file;

If that works, then we're basically done, just need to hook it to a getenv("https_proxy") (or http_proxy depending on url), and clean it all up.

Yes, this works, but with the limitation that it only works for HTTP, not HTTPS. But it seems that's an issue with uclient-fetch...