From 0e4c8fc92019763b596a0a3f17bd122bb1446a7f Mon Sep 17 00:00:00 2001 From: Martin Zihlmann Date: Thu, 14 May 2026 17:14:13 +0200 Subject: [PATCH] derp/derphttp: honor DERPNode.DERPPort in proxied CONNECT dial dialNode picks the destination port from n.DERPPort when non-zero, falling back to 443 (or 3340 when useHTTPS is false). The proxy path, dialNodeUsingProxy, hardcoded "443" in the CONNECT target, so a DERP server reachable only on a custom port was unreachable through HTTPS_PROXY: the proxy would faithfully tunnel to :443 at the DERP hostname, and TLS would either fail cert validation or talk to the wrong service. Mirror dialNode's port selection so both paths behave the same. Fixes #19748 Signed-off-by: Martin Zihlmann --- derp/derphttp/derphttp_client.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/derp/derphttp/derphttp_client.go b/derp/derphttp/derphttp_client.go index 3c8408e95..c52ee33c7 100644 --- a/derp/derphttp/derphttp_client.go +++ b/derp/derphttp/derphttp_client.go @@ -867,7 +867,15 @@ func (c *Client) dialNodeUsingProxy(ctx context.Context, n *tailcfg.DERPNode, pr } }() - target := net.JoinHostPort(n.HostName, "443") + // Keep port selection in sync with dialNode. + port := "443" + if !c.useHTTPS() { + port = "3340" + } + if n.DERPPort != 0 { + port = fmt.Sprint(n.DERPPort) + } + target := net.JoinHostPort(n.HostName, port) var authHeader string if buildfeatures.HasUseProxy {