feat: add TARGET_SNI to allow overriding the TLS handshake hostname when forwarding requests #529
+14
−6
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…hen forwarding requests
Xe
approved these changes
May 23, 2025
Signed-off-by: Xe Iaso <me@xeiaso.net>
JasonLovesDoggo
pushed a commit
to JasonLovesDoggo/anubis
that referenced
this pull request
Jun 17, 2025
…hen forwarding requests (TecharoHQ#529) * feat: add TARGET_SNI to allow overriding the TLS handshake hostname when forwarding requests * chore: spelling Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When running Anubis in front of a site that's served from a different host, it's nice to be able to specify HTTPS for the
TARGETand stay end-to-end encrypted.If that backend server is shared hosting, then the site's own hostname may be the only one that's correct to specify in the TLS handshake (SNI) - but it will be different than the hostname Anubis needs to resolve and connect to.
For example, let's say the site is
site1.example.comand its backend server isbackend.example.com. DNS forsite1points at Anubis, not the backend server.https://backend.example.comis the appropriateTARGET, but it hosts tons of other sites. If Anubis' handshake and Host header ask forbackend.example.comit'll serve its default site (wrong), and if Anubis' handshake and Host header mismatch it'll probably serve a 421 Misdirected Request.You could work around this by naming the site
site1-backend.example.comon the backend server and adding that to DNS, but there are configurations where this isn't easy or elegant to do.So, adding
TARGET_SNIallows Anubis to handle this. This is very similar to #507, but I can imagine scenarios where you might want one without the other.I chose to write nested
ifstatements so that we customizeTLSClientConfigonly when needed.Checklist:
[Unreleased]section of docs/docs/CHANGELOG.mdnpm run test:integration(unsupported on Windows, please use WSL)