fix(http): forward plain HTTP proxy requests

lib/pleroma/gun/conn.ex

@@ -42,6 +42,21 @@ defmodule Pleroma.Gun.Conn do
     Map.put(opts, :tls_opts, tls_opts)
   end
 
+  defp do_open(%URI{scheme: "http"} = uri, %{proxy: {proxy_host, proxy_port}} = opts) do
+    with open_opts <- opts |> proxy_open_opts() |> Map.put(:protocols, [:http]),
+         {:ok, conn} <- Gun.open(proxy_host, proxy_port, open_opts),
+         {:ok, protocol} <- await_up(conn, opts[:connect_timeout]) do
+      {:ok, conn, protocol, :forward_proxy}
+    else
+      error ->
+        Logger.warning(
+          "Opening forward proxy connection to #{compose_uri_log(uri)} failed with error #{inspect(error)}"
+        )
+
+        error
+    end
+  end
+
   defp do_open(uri, %{proxy: {proxy_host, proxy_port}} = opts) do
     connect_opts =
       uri
@@ -174,12 +189,12 @@ defmodule Pleroma.Gun.Conn do
           error -> error
         end
 
-      {:response, _fin, 403, _headers} ->
-        close_with_error(conn, :unauthorized)
-
       {:response, _fin, 407, _headers} ->
         close_with_error(conn, :proxy_auth_failed)
 
+      {:response, _fin, status, _headers} when is_integer(status) ->
+        close_with_error(conn, {:proxy_connect_failed, status})
+
       error ->
         Gun.close(conn)
         error

lib/pleroma/gun/connection_pool.ex

@@ -208,7 +208,7 @@ defmodule Pleroma.Gun.ConnectionPool do
     call_worker(conn_pid, {:release_stream, stream})
   end
 
-  @spec tunnel_ref(pid()) :: reference() | nil
+  @spec tunnel_ref(pid()) :: reference() | :forward_proxy | nil
   def tunnel_ref(conn_pid) do
     case Registry.select(@registry, [
            {{:_, :_, {:"$1", :"$2"}}, [{:==, :"$1", conn_pid}], [:"$2"]}

lib/pleroma/http/adapter/gun.ex

@@ -34,9 +34,10 @@ defmodule Pleroma.HTTP.Adapter.Gun do
 
   defp request(env, %{conn: conn, tunnel: tunnel} = opts) do
     uri = URI.parse(Tesla.build_url(env))
-    path = Tesla.Adapter.Shared.prepare_path(uri.path, uri.query)
+    path = request_path(uri, tunnel)
     method = Tesla.Adapter.Shared.format_method(env.method)
     {headers, body, send_body} = prepare_body(env.headers, env.body, opts[:send_body])
+    headers = maybe_add_forward_proxy_headers(headers, uri, opts, tunnel)
     request_opts = request_opts(opts[:reply_to], tunnel)
 
     stream =
@@ -76,10 +77,46 @@ defmodule Pleroma.HTTP.Adapter.Gun do
 
   defp request_opts(reply_to, nil), do: %{reply_to: reply_to || self()}
 
+  defp request_opts(reply_to, :forward_proxy), do: %{reply_to: reply_to || self()}
+
   defp request_opts(reply_to, tunnel) do
     %{reply_to: reply_to || self(), tunnel: tunnel}
   end
 
+  defp request_path(uri, :forward_proxy) do
+    path = Tesla.Adapter.Shared.prepare_path(uri.path, uri.query)
+    "#{uri.scheme}://#{authority(uri)}#{path}"
+  end
+
+  defp request_path(uri, _tunnel) do
+    Tesla.Adapter.Shared.prepare_path(uri.path, uri.query)
+  end
+
+  defp maybe_add_forward_proxy_headers(headers, uri, opts, :forward_proxy) do
+    headers
+    |> put_header_new("host", authority(uri))
+    |> maybe_put_proxy_authorization(opts)
+  end
+
+  defp maybe_add_forward_proxy_headers(headers, _uri, _opts, _tunnel), do: headers
+
+  defp maybe_put_proxy_authorization(headers, %{proxy_auth: {username, password}})
+       when is_binary(username) and is_binary(password) do
+    value = "Basic " <> Base.encode64(username <> ":" <> password)
+    List.keystore(headers, "proxy-authorization", 0, {"proxy-authorization", value})
+  end
+
+  defp maybe_put_proxy_authorization(headers, _opts), do: headers
+
+  defp put_header_new(headers, name, value) do
+    if List.keymember?(headers, name, 0), do: headers, else: [{name, value} | headers]
+  end
+
+  defp authority(%URI{scheme: scheme, host: host, port: port}) do
+    host = if String.contains?(host, ":"), do: "[#{host}]", else: host
+    if port == URI.default_port(scheme), do: host, else: "#{host}:#{port}"
+  end
+
   defp prepare_body(headers, %Multipart{} = multipart, _send_body) do
     {format_headers(headers ++ Multipart.headers(multipart)), Multipart.body(multipart), :stream}
   end