http: send SNI when connecting to https proxies

lib/internal/http.js

@@ -19,7 +19,7 @@ const {
 
 const { URL } = require('internal/url');
 const { Buffer } = require('buffer');
-const { isIPv4 } = require('internal/net');
+const { isIP, isIPv4 } = require('internal/net');
 const { ERR_PROXY_INVALID_CONFIG } = require('internal/errors').codes;
 let utcCache;
 let utcHeaderCache;
@@ -149,6 +149,10 @@ class ProxyConfig {
       // The port comes from parsed URL so it is either '' or a valid number string.
       port: port ? Number(port) : (protocol === 'https:' ? 443 : 80),
     };
+    // Send SNI to HTTPS proxies, but not for IP addresses, which are not valid SNI values.
+    if (protocol === 'https:' && !isIP(this.proxyConnectionOptions.host)) {
+      this.proxyConnectionOptions.servername = this.proxyConnectionOptions.host;
+    }
   }
 
   // See: https://about.gitlab.com/blog/we-need-to-talk-no-proxy

test/client-proxy/test-http-proxy-request-https-proxy.mjs

@@ -23,6 +23,9 @@ await once(server, 'listening');
 
 // Start an HTTPS proxy server.
 const { proxy, logs } = createProxyServer({ https: true });
+proxy.on('secureConnection', common.mustCall((socket) => {
+  assert.strictEqual(socket.servername, 'localhost');
+}));
 proxy.listen(0);
 await once(proxy, 'listening');
 

test/client-proxy/test-https-proxy-request-https-proxy.mjs

@@ -29,6 +29,9 @@ await once(server, 'listening');
 
 // Start an HTTPS proxy server.
 const { proxy, logs } = createProxyServer({ https: true });
+proxy.on('secureConnection', common.mustCall((socket) => {
+  assert.strictEqual(socket.servername, 'localhost');
+}));
 proxy.listen(0);
 await once(proxy, 'listening');