clean up config/cmdline, fix bugs, remove cruft

2 files changed, 89 insertions, 145 deletions

diff --git a/libmproxy/proxy/config.py b/libmproxy/proxy/config.py
index f438e9c2..8ab5a216 100644
--- a/libmproxy/proxy/config.py
+++ b/libmproxy/proxy/config.py
@@ -1,4 +1,5 @@
 from __future__ import absolute_import
+import collections
 import os
 import re
 from OpenSSL import SSL
@@ -7,6 +8,7 @@ from netlib import certutils, tcp
 from netlib.http import authentication
 
 from .. import utils, platform
+from netlib.tcp import Address
 
 CONF_BASENAME = "mitmproxy"
 CA_DIR = "~/.mitmproxy"
@@ -15,8 +17,9 @@ CA_DIR = "~/.mitmproxy"
 # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.2.15&openssl=1.0.2&hsts=yes&profile=old
 DEFAULT_CLIENT_CIPHERS = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
 
+
 class HostMatcher(object):
-    def __init__(self, patterns=[]):
+    def __init__(self, patterns=tuple()):
         self.patterns = list(patterns)
         self.regexes = [re.compile(p, re.IGNORECASE) for p in self.patterns]
 
@@ -32,6 +35,9 @@ class HostMatcher(object):
         return bool(self.patterns)
 
 
+ServerSpec = collections.namedtuple("ServerSpec", "scheme address")
+
+
 class ProxyConfig:
     def __init__(
             self,
@@ -41,19 +47,19 @@ class ProxyConfig:
             clientcerts=None,
             no_upstream_cert=False,
             body_size_limit=None,
-            mode=None,
+            mode="regular",
             upstream_server=None,
             authenticator=None,
-            ignore_hosts=[],
-            tcp_hosts=[],
+            ignore_hosts=tuple(),
+            tcp_hosts=tuple(),
             ciphers_client=None,
             ciphers_server=None,
-            certs=[],
+            certs=tuple(),
             ssl_version_client="secure",
             ssl_version_server="secure",
             ssl_verify_upstream_cert=False,
-            ssl_upstream_trusted_cadir=None,
-            ssl_upstream_trusted_ca=None,
+            ssl_verify_upstream_trusted_cadir=None,
+            ssl_verify_upstream_trusted_ca=None,
     ):
         self.host = host
         self.port = port
@@ -63,7 +69,10 @@ class ProxyConfig:
         self.no_upstream_cert = no_upstream_cert
         self.body_size_limit = body_size_limit
         self.mode = mode
-        self.upstream_server = upstream_server
+        if upstream_server:
+            self.upstream_server = ServerSpec(upstream_server[0], Address.wrap(upstream_server[1]))
+        else:
+            self.upstream_server = None
 
         self.check_ignore = HostMatcher(ignore_hosts)
         self.check_tcp = HostMatcher(tcp_hosts)
@@ -76,57 +85,46 @@ class ProxyConfig:
         for spec, cert in certs:
             self.certstore.add_cert_file(spec, cert)
 
-        self.openssl_method_client, self.openssl_options_client = version_to_openssl(
-            ssl_version_client)
-        self.openssl_method_server, self.openssl_options_server = version_to_openssl(
-            ssl_version_server)
+        self.openssl_method_client, self.openssl_options_client = \
+            sslversion_choices[ssl_version_client]
+        self.openssl_method_server, self.openssl_options_server = \
+            sslversion_choices[ssl_version_server]
 
         if ssl_verify_upstream_cert:
             self.openssl_verification_mode_server = SSL.VERIFY_PEER
         else:
             self.openssl_verification_mode_server = SSL.VERIFY_NONE
-        self.openssl_trusted_cadir_server = ssl_upstream_trusted_cadir
-        self.openssl_trusted_ca_server = ssl_upstream_trusted_ca
-
-
-sslversion_choices = (
-    "all",
-    "secure",
-    "SSLv2",
-    "SSLv3",
-    "TLSv1",
-    "TLSv1_1",
-    "TLSv1_2")
-
-
-def version_to_openssl(version):
-    """
-    Convert a reasonable SSL version specification into the format OpenSSL expects.
-    Don't ask...
-    https://bugs.launchpad.net/pyopenssl/+bug/1020632/comments/3
-    """
-    if version == "all":
-        return SSL.SSLv23_METHOD, None
-    elif version == "secure":
-        # SSLv23_METHOD + NO_SSLv2 + NO_SSLv3 == TLS 1.0+
-        # TLSv1_METHOD would be TLS 1.0 only
-        return SSL.SSLv23_METHOD, (SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3)
-    elif version in sslversion_choices:
-        return getattr(SSL, "%s_METHOD" % version), None
-    else:
-        raise ValueError("Invalid SSL version: %s" % version)
+        self.openssl_trusted_cadir_server = ssl_verify_upstream_trusted_cadir
+        self.openssl_trusted_ca_server = ssl_verify_upstream_trusted_ca
+
+
+"""
+Map a reasonable SSL version specification into the format OpenSSL expects.
+Don't ask...
+https://bugs.launchpad.net/pyopenssl/+bug/1020632/comments/3
+"""
+sslversion_choices = {
+    "all": (SSL.SSLv23_METHOD, 0),
+    # SSLv23_METHOD + NO_SSLv2 + NO_SSLv3 == TLS 1.0+
+    # TLSv1_METHOD would be TLS 1.0 only
+    "secure": (SSL.SSLv23_METHOD, (SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3)),
+    "SSLv2": (SSL.SSLv2_METHOD, 0),
+    "SSLv3": (SSL.SSLv3_METHOD, 0),
+    "TLSv1": (SSL.TLSv1_METHOD, 0),
+    "TLSv1_1": (SSL.TLSv1_1_METHOD, 0),
+    "TLSv1_2": (SSL.TLSv1_2_METHOD, 0),
+}
 
 
 def process_proxy_options(parser, options):
     body_size_limit = utils.parse_size(options.body_size_limit)
 
     c = 0
-    mode, upstream_server, spoofed_ssl_port = None, None, None
+    mode, upstream_server = "regular", None
     if options.transparent_proxy:
         c += 1
         if not platform.resolver:
-            return parser.error(
-                "Transparent mode not supported on this platform.")
+            return parser.error("Transparent mode not supported on this platform.")
         mode = "transparent"
     if options.socks_proxy:
         c += 1
@@ -139,32 +137,26 @@ def process_proxy_options(parser, options):
         c += 1
         mode = "upstream"
         upstream_server = options.upstream_proxy
-    if options.spoof_mode:
-        c += 1
-        mode = "spoof"
-    if options.ssl_spoof_mode:
-        c += 1
-        mode = "sslspoof"
-        spoofed_ssl_port = options.spoofed_ssl_port
     if c > 1:
         return parser.error(
             "Transparent, SOCKS5, reverse and upstream proxy mode "
-            "are mutually exclusive.")
+            "are mutually exclusive. Read the docs on proxy modes to understand why."
+        )
 
     if options.clientcerts:
         options.clientcerts = os.path.expanduser(options.clientcerts)
-        if not os.path.exists(
-                options.clientcerts) or not os.path.isdir(
-                options.clientcerts):
+        if not os.path.exists(options.clientcerts) or not os.path.isdir(options.clientcerts):
             return parser.error(
                 "Client certificate directory does not exist or is not a directory: %s" %
-                options.clientcerts)
+                options.clientcerts
+            )
 
-    if (options.auth_nonanonymous or options.auth_singleuser or options.auth_htpasswd):
+    if options.auth_nonanonymous or options.auth_singleuser or options.auth_htpasswd:
         if options.auth_singleuser:
             if len(options.auth_singleuser.split(':')) != 2:
                 return parser.error(
-                    "Invalid single-user specification. Please use the format username:password")
+                    "Invalid single-user specification. Please use the format username:password"
+                )
             username, password = options.auth_singleuser.split(':')
             password_manager = authentication.PassManSingleUser(username, password)
         elif options.auth_nonanonymous:
@@ -189,12 +181,6 @@ def process_proxy_options(parser, options):
             parser.error("Certificate file does not exist: %s" % parts[1])
         certs.append(parts)
 
-    ssl_ports = options.ssl_ports
-    if options.ssl_ports != TRANSPARENT_SSL_PORTS:
-        # arparse appends to default value by default, strip that off.
-        # see http://bugs.python.org/issue16399
-        ssl_ports = ssl_ports[len(TRANSPARENT_SSL_PORTS):]
-
     return ProxyConfig(
         host=options.addr,
         port=options.port,
@@ -204,87 +190,15 @@ def process_proxy_options(parser, options):
         body_size_limit=body_size_limit,
         mode=mode,
         upstream_server=upstream_server,
-        http_form_in=options.http_form_in,
-        http_form_out=options.http_form_out,
         ignore_hosts=options.ignore_hosts,
         tcp_hosts=options.tcp_hosts,
         authenticator=authenticator,
         ciphers_client=options.ciphers_client,
         ciphers_server=options.ciphers_server,
-        certs=certs,
+        certs=tuple(certs),
         ssl_version_client=options.ssl_version_client,
         ssl_version_server=options.ssl_version_server,
-        ssl_ports=ssl_ports,
-        spoofed_ssl_port=spoofed_ssl_port,
         ssl_verify_upstream_cert=options.ssl_verify_upstream_cert,
-        ssl_upstream_trusted_cadir=options.ssl_upstream_trusted_cadir,
-        ssl_upstream_trusted_ca=options.ssl_upstream_trusted_ca
-    )
-
-
-def ssl_option_group(parser):
-    group = parser.add_argument_group("SSL")
-    group.add_argument(
-        "--cert",
-        dest='certs',
-        default=[],
-        type=str,
-        metavar="SPEC",
-        action="append",
-        help='Add an SSL certificate. SPEC is of the form "[domain=]path". '
-        'The domain may include a wildcard, and is equal to "*" if not specified. '
-        'The file at path is a certificate in PEM format. If a private key is included in the PEM, '
-        'it is used, else the default key in the conf dir is used. '
-        'The PEM file should contain the full certificate chain, with the leaf certificate as the first entry. '
-        'Can be passed multiple times.')
-    group.add_argument(
-        "--ciphers-client", action="store",
-        type=str, dest="ciphers_client", default=DEFAULT_CLIENT_CIPHERS,
-        help="Set supported ciphers for client connections. (OpenSSL Syntax)"
-    )
-    group.add_argument(
-        "--ciphers-server", action="store",
-        type=str, dest="ciphers_server", default=None,
-        help="Set supported ciphers for server connections. (OpenSSL Syntax)"
-    )
-    group.add_argument(
-        "--client-certs", action="store",
-        type=str, dest="clientcerts", default=None,
-        help="Client certificate directory."
-    )
-    group.add_argument(
-        "--no-upstream-cert", default=False,
-        action="store_true", dest="no_upstream_cert",
-        help="Don't connect to upstream server to look up certificate details."
-    )
-    group.add_argument(
-        "--verify-upstream-cert", default=False,
-        action="store_true", dest="ssl_verify_upstream_cert",
-        help="Verify upstream server SSL/TLS certificates and fail if invalid "
-             "or not present."
-    )
-    group.add_argument(
-        "--upstream-trusted-cadir", default=None, action="store",
-        dest="ssl_upstream_trusted_cadir",
-        help="Path to a directory of trusted CA certificates for upstream "
-             "server verification prepared using the c_rehash tool."
-    )
-    group.add_argument(
-        "--upstream-trusted-ca", default=None, action="store",
-        dest="ssl_upstream_trusted_ca",
-        help="Path to a PEM formatted trusted CA certificate."
-    )
-    group.add_argument(
-        "--ssl-version-client", dest="ssl_version_client",
-        default="secure", action="store",
-        choices=sslversion_choices,
-        help="Set supported SSL/TLS version for client connections. "
-             "SSLv2, SSLv3 and 'all' are INSECURE. Defaults to secure."
-    )
-    group.add_argument(
-        "--ssl-version-server", dest="ssl_version_server",
-        default="secure", action="store",
-        choices=sslversion_choices,
-        help="Set supported SSL/TLS version for server connections. "
-             "SSLv2, SSLv3 and 'all' are INSECURE. Defaults to secure."
-    )
+        ssl_verify_upstream_trusted_cadir=options.ssl_verify_upstream_trusted_cadir,
+        ssl_verify_upstream_trusted_ca=options.ssl_verify_upstream_trusted_ca
+    )
\ No newline at end of file
diff --git a/libmproxy/proxy/server.py b/libmproxy/proxy/server.py
index 19ddb930..1fc4cbda 100644
--- a/libmproxy/proxy/server.py
+++ b/libmproxy/proxy/server.py
@@ -5,6 +5,8 @@ import sys
 import socket
 from libmproxy.protocol2.layer import Kill
 from netlib import tcp
+from netlib.http.http1 import HTTP1Protocol
+from netlib.tcp import NetLibError
 
 from ..protocol.handle import protocol_handler
 from .. import protocol2
@@ -82,11 +84,31 @@ class ConnectionHandler2:
             self.channel
         )
 
-        # FIXME: properly parse config
-        if self.config.mode == "upstream":
-            root_layer = protocol2.HttpUpstreamProxy(root_context, ("localhost", 8081))
-        else:
+        mode = self.config.mode
+        if mode == "upstream":
+            root_layer = protocol2.HttpUpstreamProxy(
+                root_context,
+                self.config.upstream_server.address
+            )
+        elif mode == "transparent":
+            root_layer = protocol2.TransparentProxy(root_context)
+        elif mode == "reverse":
+            client_tls = self.config.upstream_server.scheme.startswith("https")
+            server_tls = self.config.upstream_server.scheme.endswith("https")
+            root_layer = protocol2.ReverseProxy(
+                root_context,
+                self.config.upstream_server.address,
+                client_tls,
+                server_tls
+            )
+        elif mode == "socks5":
+            root_layer = protocol2.Socks5Proxy(root_context)
+        elif mode == "regular":
             root_layer = protocol2.HttpProxy(root_context)
+        elif callable(mode):  # pragma: nocover
+            root_layer = mode(root_context)
+        else:  # pragma: nocover
+            raise ValueError("Unknown proxy mode: %s" % mode)
 
         try:
             root_layer()
@@ -94,6 +116,14 @@ class ConnectionHandler2:
             self.log("Connection killed", "info")
         except ProtocolException as e:
             self.log(e, "info")
+            # If an error propagates to the topmost level,
+            # we send an HTTP error response, which is both
+            # understandable by HTTP clients and humans.
+            try:
+                error_response = protocol2.make_error_response(502, repr(e))
+                self.client_conn.send(HTTP1Protocol().assemble(error_response))
+            except NetLibError:
+                pass
         except Exception:
             self.log(traceback.format_exc(), "error")
             print(traceback.format_exc(), file=sys.stderr)