Allow IP proxy connections without SNI

Author: andre487

roles/https_proxy/templates/gost.yml.j2

@@ -21,7 +21,7 @@ services:
       tls:
         certFile: {{ megaproxy_container_certificate_directory }}/fullchain.pem
         keyFile: {{ megaproxy_container_certificate_directory }}/privkey.pem
-        rejectUnknownSNI: true
+        rejectUnknownSNI: {{ (not route.is_ip) | lower }}
         serverNames: [{{ route.hostname | to_json }}]
         options:
           minVersion: VersionTLS12

src/megaproxy_server/inventory.py

@@ -137,7 +137,7 @@ def https_routes(inventory: Inventory, name: str) -> list[dict[str, Any]]:
     routes: list[dict[str, Any]] = []
     entry_title = https.title or _host_title(name)
     if https.direct:
-        routes.append({"name": "direct", "hostname": https.endpoint, "title": entry_title, "country_code": name.split("_", 1)[0].upper(), "port": inventory.settings.https_chain_backend_port, "chain": None, "probe_resistance": https.probe_resistance.model_dump(mode="json")})
+        routes.append({"name": "direct", "hostname": https.endpoint, "is_ip": _is_ip(https.endpoint), "title": entry_title, "country_code": name.split("_", 1)[0].upper(), "port": inventory.settings.https_chain_backend_port, "chain": None, "probe_resistance": https.probe_resistance.model_dump(mode="json")})
     if inventory.settings.https_chains_enabled and https.chain_entry:
         configured_pairs = [pair for pair in inventory.settings.https_chain_pairs if pair.entry == name]
         allowed_exits = {pair.exit for pair in configured_pairs} if inventory.settings.https_chain_pairs else None
@@ -153,9 +153,11 @@ def https_routes(inventory: Inventory, name: str) -> list[dict[str, Any]]:
         ]
         for index, (exit_name, exit_https) in enumerate(exits, start=len(routes)):
             probe_resistance = pair_probe_resistance.get(exit_name) or https.probe_resistance
+            route_hostname = pair_hostnames.get(exit_name) or f"{_dns_label(name)}-via-{_dns_label(exit_name)}.{inventory.settings.https_chain_domain}"
             routes.append({
                 "name": f"via-{exit_name}",
-                "hostname": pair_hostnames.get(exit_name) or f"{_dns_label(name)}-via-{_dns_label(exit_name)}.{inventory.settings.https_chain_domain}",
+                "hostname": route_hostname,
+                "is_ip": _is_ip(route_hostname),
                 "title": pair_titles.get(exit_name) or entry_title,
                 "country_code": pair_country_codes.get(exit_name) or exit_name.split("_", 1)[0].upper(),
                 "port": inventory.settings.https_chain_backend_port + index,
@@ -169,6 +171,14 @@ def _dns_label(value: str) -> str:
     return re.sub(r"[^a-z0-9-]+", "-", value.lower()).strip("-")
 
 
+def _is_ip(value: str) -> bool:
+    try:
+        ipaddress.ip_address(value)
+    except ValueError:
+        return False
+    return True
+
+
 def _host_title(name: str) -> str:
     parts = name.split("_")
     if parts[-1:] == ["proxy"]:

tests/test_https_proxy_role.py

@@ -56,6 +56,7 @@ def test_https_proxy_uses_http2() -> None:
 
     assert "type: http2" in template
     assert "alpn: [h2, http/1.1]" in template
+    assert "rejectUnknownSNI: {{ (not route.is_ip) | lower }}" in template
 
     verify = (ROOT / "playbooks" / "verify.yml").read_text(encoding="utf-8")
     assert "--proxy-http2" not in verify

tests/test_inventory.py

@@ -102,6 +102,7 @@ def test_https_sni_routes_are_generated_for_every_exit() -> None:
     )
     routes = https_routes(inventory, "proxy_ru")
     assert [route["hostname"] for route in routes] == ["ru.example", "proxy-ru-via-proxy-nl.chains.example"]
+    assert [route["is_ip"] for route in routes] == [False, False]
     assert [route["title"] for route in routes] == ["PROXY Ru", "Russia via Netherlands"]
     projected = ansible_inventory(inventory)["all"]["hosts"]["proxy_ru"]["megaproxy_services"]["https"]
     assert projected["routes"][1]["chain"]["host"] == "nl.example"
@@ -120,6 +121,28 @@ def test_https_sni_routes_are_generated_for_every_exit() -> None:
     assert ansible_inventory(inventory)["all"]["vars"]["megaproxy_users"]["https"][0]["name"] == "alice"
 
 
+def test_ip_https_route_allows_clients_without_sni() -> None:
+    admin = AdminAccess(user="deploy", private_key_file="/keys/admin", public_key="ssh-ed25519 AAAA admin")
+    user = HttpsUser(name="alice", password="long-password-alice")
+    inventory = Inventory(
+        hosts={
+            "proxy_us": Host(
+                address="192.0.2.1",
+                admin=admin,
+                services=Services(
+                    https=HttpsService(
+                        endpoint="192.0.2.1",
+                        certificate="self-signed",
+                        users=[user],
+                    )
+                ),
+            )
+        }
+    )
+
+    assert https_routes(inventory, "proxy_us")[0]["is_ip"] is True
+
+
 def test_route_probe_override_is_independent() -> None:
     admin = AdminAccess(user="deploy", private_key_file="/keys/admin", public_key="ssh-ed25519 AAAA admin")
     user = HttpsUser(name="alice", password="long-password-alice")