fix(tls): skip server_name override when dialing an HTTPS proxy by gwenaskell · Pull Request #25899 · vectordotdev/vector

gwenaskell · 2026-07-20T08:10:59Z

Summary

Follow-up to the merged tls.server_name OpenSSL verification fix (#25881).

The proxy connector uses one inner HttpsConnector to dial both the destination directly (no_proxy) and, for proxied requests, the proxy itself (hyper-proxy calls self.connector.call(proxy_url)). Its per-connection callback pins the X509 verify parameter to the destination tls.server_name. For an HTTPS proxy that means the proxy's own certificate gets verified against the upstream server_name, failing with a hostname mismatch.

apply_connect_configuration gains a skip_server_name flag; when set it behaves as if no server_name were configured (verification falls back to the connection URL host).
The connector callback compares the target host against the configured proxy hosts and skips the server_name override when dialing a proxy.
build_proxy_connector collects the proxy hosts (when enabled) and passes them to the connector; build_tls_connector passes an empty list so direct callers are unaffected.

Result:

Direct / no_proxy destination -> server_name applied (verified against server_name).
HTTPS proxy connection -> server_name skipped (proxy cert verified against the proxy host).
Tunneled destination TLS through a proxy -> unchanged; server_name still can't be applied there (hyper-proxy limitation), which the existing warn! covers.

Test plan

cargo test -p vector-core --lib tls::settings::test — the end-to-end handshake test now also asserts that with the override skipped, connecting by IP with server_name set fails (i.e. verifies against the URL host, as a proxy connection would).
cargo check --lib for the vector crate.

Change Type

Is this a breaking change?

Yes
No

Does this PR include user facing changes?

Yes. A changelog fragment is included. (I actually updated the previous fragment)
No. A maintainer will apply the no-changelog label to this PR.

The inner connector's callback runs for both direct destination connections and the TLS connection to an HTTPS forward proxy. Pinning the verify parameter to the destination `server_name` on the proxy connection would verify the proxy's own certificate against the upstream name and fail with a hostname mismatch. Exclude the configured proxy hosts from the `server_name` override so proxy certificates are verified against the proxy host.

Both fixes ship in the same release, so combine them into a single changelog entry.

datadog-vectordotdev · 2026-07-20T08:19:15Z

Tests

⚠️ Warnings

🚦 1 Pipeline job failed

Changelog | validate-changelog

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 939d1cd | Docs | Give us feedback!}

There are only ever two proxy hosts (http and https), so a small struct with a matches() helper is clearer than a Vec.

gwenaskell · 2026-07-20T08:39:48Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e15eba97d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…r_name skip The previous host-only check could skip the server_name override for a direct destination connection that merely shared a host with a configured proxy (e.g. a no_proxy bypass on a different port, or an https destination sharing a host with an http-scheme proxy). Only track proxies reached over TLS (https:// URLs) and match the full authority (host and port) so the skip applies solely to the actual proxy connection.

…gured

gwenaskell · 2026-07-20T09:21:47Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e818acba96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

vladimir-dd

Left some minor suggestions, otherwise makes sense to me.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 939d1cdb2c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pront

This change makes sense to me. I left one quesiton.

gwenaskell added 2 commits July 20, 2026 10:10

chore(tls): add changelog fragment for proxy server_name fix

c497891

github-actions Bot added the domain: core Anything related to core crates i.e. vector-core, core-common, etc label Jul 20, 2026

gwenaskell added 2 commits July 20, 2026 10:13

chore(tls): add author to proxy server_name changelog fragment

656f9b5

chore(tls): merge proxy fix into the server_name changelog fragment

df1ea6a

Both fixes ship in the same release, so combine them into a single changelog entry.

refactor(tls): use a ProxyHosts struct instead of a Vec

1e15eba

There are only ever two proxy hosts (http and https), so a small struct with a matches() helper is clearer than a Vec.

chatgpt-codex-connector Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread src/http.rs Outdated

gwenaskell added 2 commits July 20, 2026 11:02

perf(tls): short-circuit proxy authority match when no proxy is confi…

e818acb

…gured

chatgpt-codex-connector Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread src/http.rs

gwenaskell marked this pull request as ready for review July 20, 2026 09:57

gwenaskell requested a review from a team as a code owner July 20, 2026 09:57

vladimir-dd reviewed Jul 20, 2026

View reviewed changes

Comment thread changelog.d/tls_server_name_openssl_verify.fix.md Outdated

vladimir-dd reviewed Jul 20, 2026

View reviewed changes

Comment thread src/http.rs Outdated

vladimir-dd approved these changes Jul 20, 2026

View reviewed changes

gwenaskell added 2 commits July 20, 2026 13:40

rephrase changelog

30e26ae

rename ProxyAuthorities to TlsProxyAuthorities

939d1cd

gwenaskell requested a review from guilload July 20, 2026 11:47

chatgpt-codex-connector Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread src/http.rs

pront added the no-changelog Changes in this PR do not need user-facing explanations in the release changelog label Jul 20, 2026

pront approved these changes Jul 21, 2026

View reviewed changes

Comment thread src/http.rs

gwenaskell enabled auto-merge July 21, 2026 14:13

gwenaskell added this pull request to the merge queue Jul 21, 2026

gwenaskell mentioned this pull request Jul 21, 2026

TLS server_name override can be wrongly skipped when a direct destination shares an authority with an HTTPS proxy #25914

Open

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(tls): skip server_name override when dialing an HTTPS proxy#25899

fix(tls): skip server_name override when dialing an HTTPS proxy#25899
gwenaskell wants to merge 9 commits into
masterfrom
yoenn.burban/OPA-6001-skip-server-name-for-proxy

gwenaskell commented Jul 20, 2026 •

edited

Loading

Uh oh!

datadog-vectordotdev Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

gwenaskell commented Jul 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

gwenaskell commented Jul 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vladimir-dd left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

pront left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

gwenaskell commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Change Type

Is this a breaking change?

Does this PR include user facing changes?

Uh oh!

datadog-vectordotdev Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

gwenaskell commented Jul 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

gwenaskell commented Jul 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vladimir-dd left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

pront left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gwenaskell commented Jul 20, 2026 •

edited

Loading

datadog-vectordotdev Bot commented Jul 20, 2026 •

edited

Loading