You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "arturobernalg (via GitHub)" <gi...@apache.org> on 2025/05/08 13:25:12 UTC
[PR] Httpclient 2368 - Support multiple TLS handshakes for HTTPS-proxy flows [httpcomponents-core]
arturobernalg opened a new pull request, #519:
URL: https://github.com/apache/httpcomponents-core/pull/519
HI @ok2c
Not sure if this is a stupid idea or makes any sense,
but to solve HTTPCLIENT-2368 I’m proposing only a change in InternalDataChannel.startTls(...):
Detect and clear any existing SSLIOSession, revert to raw I/O, then install a fresh SSLIOSession so startTls(...) can run twice (proxy → CONNECT → target) on the same channel without error.
Let me know if this narrow patch makes sense or if you’d prefer a different approach.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] Httpclient 2368 - Support multiple TLS handshakes for HTTPS-proxy flows [httpcomponents-core]
Posted by "ok2c (via GitHub)" <gi...@apache.org>.
ok2c commented on PR #519:
URL: https://github.com/apache/httpcomponents-core/pull/519#issuecomment-2903684149
@arturobernalg Please rather focus on https://github.com/apache/httpcomponents-client/pull/580 instead or if you want to work on something really complex consider looking into an event-driven implementation of GZIP for the async transport
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] Httpclient 2368 - Support multiple TLS handshakes for HTTPS-proxy flows [httpcomponents-core]
Posted by "arturobernalg (via GitHub)" <gi...@apache.org>.
arturobernalg commented on PR #519:
URL: https://github.com/apache/httpcomponents-core/pull/519#issuecomment-2903505819
> @arturobernalg The problem is not about executing TLS handshakes multiple times but about running multiple TLS sessions over the _same connection_ layered one over another.
@ok2c thanks for the deep dive—if I’m reading this right, `InternalDataChannel` permanently locks in TLS on the first handshake, so you simply can’t layer a second one on the same connection. Is there something I’m overlooking, or any other angle I should try?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] Httpclient 2368 - Support multiple TLS handshakes for HTTPS-proxy flows [httpcomponents-core]
Posted by "ok2c (via GitHub)" <gi...@apache.org>.
ok2c commented on PR #519:
URL: https://github.com/apache/httpcomponents-core/pull/519#issuecomment-2869865268
@arturobernalg The problem is not about executing TLS handshakes multiple times but about running multiple TLS sessions over the _same connection_ layered one over another.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] Httpclient 2368 - Support multiple TLS handshakes for HTTPS-proxy flows [httpcomponents-core]
Posted by "arturobernalg (via GitHub)" <gi...@apache.org>.
arturobernalg closed pull request #519: Httpclient 2368 - Support multiple TLS handshakes for HTTPS-proxy flows
URL: https://github.com/apache/httpcomponents-core/pull/519
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] Httpclient 2368 - Support multiple TLS handshakes for HTTPS-proxy flows [httpcomponents-core]
Posted by "ok2c (via GitHub)" <gi...@apache.org>.
ok2c commented on PR #519:
URL: https://github.com/apache/httpcomponents-core/pull/519#issuecomment-2903675568
> @ok2c thanks for the deep dive—if I’m reading this right, `InternalDataChannel` permanently locks in TLS on the first handshake, so you simply can’t layer a second one on the same connection. Is there something I’m overlooking, or any other angle I should try?
@arturobernalg I consciously introduced this limitation at the very beginning of HttpCore 5.0 development to reduce complexity in the TLS layer. I never expected the multiple TLS session layering to apply to our problem domain. That turned out wrong. However, it proxy tunneling over HTTPS is not particularly useful or common and I see no point fixing this limitation at this moment. This is a high effort - low reward problem. There are more important things to be done. Besides, if we want TLS layering (and other advanced things) we _might_ need to consider dropping HttpCore in favor of Netty instead.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org