[weiiwang01]

Add a new configuration option to the aproxy charm to disable SNI-based hostname extraction.

By default, aproxy inspects the TLS ClientHello and extracts the SNI to determine the destination hostname for HTTPS connections. In some environments this behaviour is undesirable, so we need a way to turn it off and fall back to the destination IP address instead.

[Copilot]

🟡 Changes recommended

The updated args-writing path still feeds an eval-based startup, creating a concrete command-injection risk via config-derived values, and the new behavior lacks direct test coverage (plus PR description vs snap-only implementation mismatch).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR introduces a use-sni option to control whether aproxy prereads TLS ClientHello SNI on port 443 to determine the CONNECT target, enabling environments to disable SNI-based hostname extraction and fall back to the original destination IP:port.

Changes:

• Add --use-sni boolean flag to aproxy and thread it into connection handling logic for port 443.
• Update the snap configure hook to read use-sni from snap configuration and persist it into the aproxy startup args.

File summaries

File	Description
snap/hooks/configure	Reads use-sni snap config and writes `--use-sni={true
aproxy.go	Adds --use-sni flag and gates SNI preread/hostname CONNECT behavior on port 443.

Review details

Suppressed comments (3)

snap/hooks/configure:48

• The args file path is unquoted; while $SNAP_DATA typically has no spaces, quoting (and using printf over echo) avoids edge cases and keeps this safe/consistent.

echo "$args" > $SNAP_DATA/args

snap/hooks/configure:44

• This validation error is emitted to stdout; it should go to stderr so callers/tools can distinguish misconfiguration from normal output.

        echo "invalid use-sni: '$use_sni' (must be true or false)"
        exit 1

snap/hooks/configure:38

• The PR description says this adds a charm configuration option, but the implementation here adds a snap configuration key (snapctl get use-sni) and this repo appears snap-only (no charm config wiring). If this is meant to be a charm-facing option (e.g., juju config), the charm layer/docs likely still need updating or the PR description should be corrected.

use_sni="$(snapctl get use-sni)"

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.