We had to make mandatory the use of a proxy in our infrastructure to access CLI port. During the journey, we made some improvement to the CLI proxy support:

• make proxy support work with recent Squid version which reply with HTTP/1.1 even if request is HTTP 1.0
• close the socket connected to the proxy if the connection failed
• output an error message when proxy connection failed
• don't do a reverse DNS lookup, instead use the host string provided in X-Jenkins-CLI-Host headers. It can be a IP address passed with hudson.TcpSlaveAgentListener.hostName (we don't know if the DNS resolver on the proxy will be able to resolve the name correctly, or like us).