Fall back to original destination IP if no SNI in the TLS handshake

.github/workflows/integration-tests.yaml

@@ -75,6 +75,12 @@ jobs:
           sudo apt install -y socat
           timeout 60 socat /dev/null TCP4:tcpbin.com:4242
 
+      - name: Test No SNI
+        run: |
+          HOST_IP=$(dig +short ubuntu.com | head -n1)
+          timeout 60 curl "https://$HOST_IP:443" -v || :
+          sudo snap logs aproxy.aproxy | grep -Fq host=$HOST_IP:443
+
       - name: Test Access Logs
         run: |
           sudo snap logs aproxy.aproxy | grep -Fq "example.com:80"

aproxy.go

@@ -16,6 +16,7 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
+	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -356,17 +357,20 @@ func HandleConn(conn net.Conn, proxy string) {
 		if err != nil {
 			logger.Error("failed to preread SNI from connection", "error", err)
 			return
-		} else {
-			host := fmt.Sprintf("%s:%d", sni, dst.Port)
-			logger = logger.With("host", host)
-			proxyConn, err := DialProxyConnect(proxy, host)
-			if err != nil {
-				logger.Error("failed to connect to http proxy", "error", err)
-				return
-			}
-			logger.Info("relay TLS connection to proxy")
-			RelayTCP(consigned, proxyConn, logger)
 		}
+		hostname := sni
+		if hostname == "" {
+			hostname = dst.IP.String()
+		}
+		host := net.JoinHostPort(hostname, strconv.Itoa(dst.Port))
+		logger = logger.With("host", host)
+		proxyConn, err := DialProxyConnect(proxy, host)
+		if err != nil {
+			logger.Error("failed to connect to http proxy", "error", err)
+			return
+		}
+		logger.Info("relay TLS connection to proxy")
+		RelayTCP(consigned, proxyConn, logger)
 	case 80, 11371:
 		host, err := PrereadHttpHost(consigned)
 		if err != nil {