[ruby/net-http] implement talking SSL to the proxy too

https://bugs.ruby-lang.org/issues/16482

ae2d83f88b

lib/net/http.rb

@@ -1103,7 +1103,7 @@ module Net   #:nodoc:
     # For proxy-defining arguments +p_addr+ through +p_no_proxy+,
     # see {Proxy Server}[rdoc-ref:Net::HTTP@Proxy+Server].
     #
-    def HTTP.new(address, port = nil, p_addr = :ENV, p_port = nil, p_user = nil, p_pass = nil, p_no_proxy = nil)
+    def HTTP.new(address, port = nil, p_addr = :ENV, p_port = nil, p_user = nil, p_pass = nil, p_no_proxy = nil, p_use_ssl = nil)
       http = super address, port
 
       if proxy_class? then # from Net::HTTP::Proxy()
@@ -1112,6 +1112,7 @@ module Net   #:nodoc:
         http.proxy_port     = @proxy_port
         http.proxy_user     = @proxy_user
         http.proxy_pass     = @proxy_pass
+        http.proxy_use_ssl  = @proxy_use_ssl
       elsif p_addr == :ENV then
         http.proxy_from_env = true
       else
@@ -1123,6 +1124,7 @@ module Net   #:nodoc:
         http.proxy_port    = p_port || default_port
         http.proxy_user    = p_user
         http.proxy_pass    = p_pass
+        http.proxy_use_ssl = p_use_ssl
       end
 
       http
@@ -1190,6 +1192,7 @@ module Net   #:nodoc:
       @proxy_port     = nil
       @proxy_user     = nil
       @proxy_pass     = nil
+      @proxy_use_ssl  = nil
 
       @use_ssl = false
       @ssl_context = nil
@@ -1324,6 +1327,7 @@ module Net   #:nodoc:
     # Sets the proxy password;
     # see {Proxy Server}[rdoc-ref:Net::HTTP@Proxy+Server].
     attr_writer :proxy_pass
+    attr_writer :proxy_use_ssl
 
     # Returns the IP address for the connection.
     #
@@ -1668,7 +1672,13 @@ module Net   #:nodoc:
       debug "opened"
       if use_ssl?
         if proxy?
-          plain_sock = BufferedIO.new(s, read_timeout: @read_timeout,
+          if @proxy_use_ssl
+            proxy_sock = OpenSSL::SSL::SSLSocket.new(s)
+            ssl_socket_connect(proxy_sock, @open_timeout)
+          else
+            proxy_sock = s
+          end
+          proxy_sock = BufferedIO.new(proxy_sock, read_timeout: @read_timeout,
                                       write_timeout: @write_timeout,
                                       continue_timeout: @continue_timeout,
                                       debug_output: @debug_output)
@@ -1679,8 +1689,8 @@ module Net   #:nodoc:
             buf << "Proxy-Authorization: Basic #{credential}\r\n"
           end
           buf << "\r\n"
-          plain_sock.write(buf)
-          HTTPResponse.read_new(plain_sock).value
+          proxy_sock.write(buf)
+          HTTPResponse.read_new(proxy_sock).value
           # assuming nothing left in buffers after successful CONNECT response
         end
 
@@ -1788,13 +1798,14 @@ module Net   #:nodoc:
     @proxy_port = nil
     @proxy_user = nil
     @proxy_pass = nil
+    @proxy_use_ssl = nil
 
     # Creates an \HTTP proxy class which behaves like \Net::HTTP, but
     # performs all access via the specified proxy.
     #
     # This class is obsolete.  You may pass these same parameters directly to
     # \Net::HTTP.new.  See Net::HTTP.new for details of the arguments.
-    def HTTP.Proxy(p_addr = :ENV, p_port = nil, p_user = nil, p_pass = nil) #:nodoc:
+    def HTTP.Proxy(p_addr = :ENV, p_port = nil, p_user = nil, p_pass = nil, p_use_ssl = nil) #:nodoc:
       return self unless p_addr
 
       Class.new(self) {
@@ -1812,6 +1823,7 @@ module Net   #:nodoc:
 
         @proxy_user = p_user
         @proxy_pass = p_pass
+        @proxy_use_ssl = p_use_ssl
       }
     end
 
@@ -1836,6 +1848,9 @@ module Net   #:nodoc:
       # Returns the password for accessing the proxy, or +nil+ if none;
       # see Net::HTTP@Proxy+Server.
       attr_reader :proxy_pass
+
+      # Use SSL when talking to the proxy. If Net::HTTP does not use a proxy, nil.
+      attr_reader :proxy_use_ssl
     end
 
     # Returns +true+ if a proxy server is defined, +false+ otherwise;