Add support for mTLS #235

mg-dd · 2023-08-22T02:51:03Z

This PR fixes two issues:

The background is that the TLS connection established by the proxy agents do not add the required parameters for mTLS / self-signed CAs. This PR adds a way to provide these parameters. The general approach was taken from the feedback from this PR: https://github.com/TooTallNate/proxy-agents/pull/195/files

ptal @TooTallNate

changeset-bot · 2023-08-22T02:51:06Z

🦋 Changeset detected

Latest commit: 041a7c5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
https-proxy-agent	Minor
socks-proxy-agent	Minor
agent-base	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2023-08-22T02:51:06Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
proxy-agents	✅ Ready (Inspect)	Visit Preview	Sep 4, 2023 9:13am

TooTallNate

Great looking PR! Thank you so much. I have some feedback, but once that's addressed I'll be happy to merge this.

packages/agent-base/src/index.ts

TooTallNate · 2023-08-23T18:32:15Z

packages/agent-base/src/index.ts

+		servername: string | undefined,
+		opts: tls.ConnectionOptions,
+		socket?: net.Socket,


Seems weird to me that socket is optional. Also, let's make it the first parameter:

Suggested change

servername: string | undefined,

opts: tls.ConnectionOptions,

socket?: net.Socket,

socket: net.Socket,

servername: string | undefined,

opts: tls.ConnectionOptions,

The reason it was optional was that pac-proxy-agent calls tls.connect without providing a socket. I've made your suggested changes and reverted the changes to pac-proxy-agent for now. Let me know how you would like to proceed in that regard.

I see. How about if we do something like this in pac-proxy-agent?

socket = net.connect(opts); if (secureEndpoint) { const servername = opts.servername || opts.host; socket = this.upgradeSocketToTls( socket, servername, opts ); }

@mg-dd Did this piece of feedback get addressed? I don't see any change in pac-proxy-agent so it looks like this still needs to be done?

packages/agent-base/src/index.ts

packages/socks-proxy-agent/src/index.ts

patrickheeney · 2023-08-29T03:06:17Z

@mg-dd Great PR! I need something similar, do you need any help pushing this over the finish line?

mg-dd · 2023-08-29T07:45:47Z

@TooTallNate this is ready for another look. The only open question is how you would like to handle the TLS connection in pac-proxy-agent.

brunobastosg · 2023-09-26T12:23:43Z

Hi, any news on this? I also need this feature.

amirbilu · 2023-10-04T09:34:09Z

Any news on this?

cptRaclette · 2023-10-22T14:41:27Z

@TooTallNate: Would love to see this feature in the proxy agents. Is there anything left to do?

ErwanRaulo · 2023-12-28T16:19:47Z

HI, any update about this PR ? 💯

marcchambon · 2024-01-22T09:05:28Z

Thank you soo much for maintaining this awesome project !
Any news ?

sibelius · 2024-01-23T14:55:00Z

can we move forward on this?

what is missing?

pebie · 2024-02-01T11:33:53Z

Thank you for this PR !
@TooTallNate Any news about moving forward ?

🙏 🙏

sibelius · 2024-04-01T20:57:59Z

we are using a patch of this pull request in production and it is working well

NasGldn · 2024-06-14T08:56:26Z

Hello, is there news about this ? We need it ! :) @TooTallNate

szubster · 2024-07-16T15:25:26Z

Any plans to get it merged?

marcotranchino · 2024-08-08T17:22:27Z

This would be really helpful.

…proxy With this change, we have update the Apple Pay Merchant Validation implementation in order to use `hpagent` and `axios` in the presence of an egress proxy, as it's the case on our AWS environments. This is needed because we want to remove the use of `requestretry`, however `axios` has a problem preventing it from working with an egress proxy[1]. For this reason, we need to use an HttpsProxyAgent with it. We would want to use `https-proxy-agent`, however it has its own problem[2]. While we wait for these issues to be fixed, we can use `hpagent` which has been tested and works well with an egress proxy. Further information in the JIRA ticket[3]. [1] axios/axios#4531 [2] TooTallNate/proxy-agents#235 [3] https://payments-platform.atlassian.net/browse/PP-12853 Co-authored-by: Jonathan Harden <[email protected]> Co-authored-by: Dominic Belcher <[email protected]> Co-authored-by: Marco Tranchino <[email protected]>

With this change, we have update the Apple Pay Merchant Validation implementation in order to use `hpagent` and `axios` in the presence of an egress proxy, as it's the case on our AWS environments. This is needed because we want to remove the use of `requestretry`, however `axios` has a problem preventing it from working with an egress proxy[1]. For this reason, we need to use an HttpsProxyAgent with it. We would want to use `https-proxy-agent`, however it has its own problem[2]. While we wait for these issues to be fixed, we can use `hpagent` which has been tested and works well with an egress proxy. Further information in the JIRA ticket[3]. [1] axios/axios#4531 [2] TooTallNate/proxy-agents#235 [3] https://payments-platform.atlassian.net/browse/PP-12853 Co-authored-by: Jonathan Harden <[email protected]> Co-authored-by: Dominic Belcher <[email protected]> Co-authored-by: Marco Tranchino <[email protected]>

FewKinG · 2024-11-25T21:21:27Z

I am working in a scenario where we have to do mTLS through an outgoing (corporate) tunneling proxy.
This is kind of an exotic setup, I know, but freaking no proxy/agent implementation I can find (and that seems to be reasonably maintained) properly supports this.

This library with this PR is exactly what I need and it works! I applied the changes from this PR locally to test and verify. For now I will therefore use my custom copy with this patch to make it work. It seems like the author has addressed the issues with pac-proxy-agent at least in some way, could you please have another look, I would really love to use the "official" version of this as soon as this is merged.

Thank you!

Chaz0r · 2024-11-26T07:58:54Z

It really would be great for us to have this PR merged. We implemented that ourselfs now and it absolutely works. But for us it would be better to have this PR officially merged.

Add support for mTLS

683b1e1

vercel bot deployed to Preview August 22, 2023 02:51 View deployment

Include changeset

d7f0cc9

vercel bot deployed to Preview August 22, 2023 02:54 View deployment

TooTallNate requested changes Aug 23, 2023

View reviewed changes

PR feedback

89bc0af

vercel bot deployed to Preview August 29, 2023 07:44 View deployment

Merge branch 'main' into mtls-support

041a7c5

vercel bot deployed to Preview September 4, 2023 09:13 View deployment

TooTallNate added agent-base https-proxy-agent socks-proxy-agent labels Sep 8, 2023

raphendyr mentioned this pull request Jul 16, 2024

Use rejectUnauthorized without proxy URL #248

Open

marcotranchino mentioned this pull request Aug 9, 2024

Use hpagent with axios for Apple Pay Merchant Validation with egress proxy alphagov/pay-frontend#3891

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for mTLS #235

Add support for mTLS #235

mg-dd commented Aug 22, 2023

changeset-bot bot commented Aug 22, 2023 •

edited

Loading

vercel bot commented Aug 22, 2023 •

edited

Loading

TooTallNate left a comment

TooTallNate Aug 23, 2023

mg-dd Aug 29, 2023

TooTallNate Sep 4, 2023 •

edited

Loading

tmisirpash Jul 14, 2024

patrickheeney commented Aug 29, 2023

mg-dd commented Aug 29, 2023

brunobastosg commented Sep 26, 2023

amirbilu commented Oct 4, 2023

cptRaclette commented Oct 22, 2023

ErwanRaulo commented Dec 28, 2023 •

edited

Loading

marcchambon commented Jan 22, 2024

sibelius commented Jan 23, 2024

pebie commented Feb 1, 2024 •

edited

Loading

sibelius commented Apr 1, 2024

NasGldn commented Jun 14, 2024

szubster commented Jul 16, 2024

marcotranchino commented Aug 8, 2024

FewKinG commented Nov 25, 2024

Chaz0r commented Nov 26, 2024

Add support for mTLS #235

Are you sure you want to change the base?

Add support for mTLS #235

Conversation

mg-dd commented Aug 22, 2023

changeset-bot bot commented Aug 22, 2023 • edited Loading

🦋 Changeset detected

vercel bot commented Aug 22, 2023 • edited Loading

TooTallNate left a comment

Choose a reason for hiding this comment

TooTallNate Aug 23, 2023

Choose a reason for hiding this comment

mg-dd Aug 29, 2023

Choose a reason for hiding this comment

TooTallNate Sep 4, 2023 • edited Loading

Choose a reason for hiding this comment

tmisirpash Jul 14, 2024

Choose a reason for hiding this comment

patrickheeney commented Aug 29, 2023

mg-dd commented Aug 29, 2023

brunobastosg commented Sep 26, 2023

amirbilu commented Oct 4, 2023

cptRaclette commented Oct 22, 2023

ErwanRaulo commented Dec 28, 2023 • edited Loading

marcchambon commented Jan 22, 2024

sibelius commented Jan 23, 2024

pebie commented Feb 1, 2024 • edited Loading

sibelius commented Apr 1, 2024

NasGldn commented Jun 14, 2024

szubster commented Jul 16, 2024

marcotranchino commented Aug 8, 2024

FewKinG commented Nov 25, 2024

Chaz0r commented Nov 26, 2024

changeset-bot bot commented Aug 22, 2023 •

edited

Loading

vercel bot commented Aug 22, 2023 •

edited

Loading

TooTallNate Sep 4, 2023 •

edited

Loading

ErwanRaulo commented Dec 28, 2023 •

edited

Loading

pebie commented Feb 1, 2024 •

edited

Loading