From 81a274eb51ea7552667a872f0b6db1aeca9315b3 Mon Sep 17 00:00:00 2001 From: Maximilian Hils Date: Fri, 27 Feb 2015 09:17:41 +0100 Subject: fix #479 --- libmproxy/proxy/server.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/server.py b/libmproxy/proxy/server.py index ea78d964..4e576067 100644 --- a/libmproxy/proxy/server.py +++ b/libmproxy/proxy/server.py @@ -285,7 +285,12 @@ class ConnectionHandler: if sni != self.server_conn.sni: self.log("SNI received: %s" % sni, "debug") - self.server_reconnect(sni) # reconnect to upstream server with SNI + # We should only re-establish upstream SSL if one of the following conditions is true: + # - We established SSL with the server previously + # - We initially wanted to establish SSL with the server, + # but the server refused to negotiate without SNI. + if self.server_conn.ssl_established or hasattr(self.server_conn, "may_require_sni"): + self.server_reconnect(sni) # reconnect to upstream server with SNI # Now, change client context to reflect changed certificate: cert, key, chain_file = self.find_cert() new_context = self.client_conn._create_ssl_context( -- cgit v1.2.3 From 3323b29f10175d4100eb00a3787fa1c15e71e413 Mon Sep 17 00:00:00 2001 From: Maximilian Hils Date: Fri, 27 Feb 2015 12:51:06 +0100 Subject: always include SNI as SAN entry To be as robust as possible, we include the SNI value always as a Subject Alternative Name. Second, we make sure that the server address is in the list as well. --- libmproxy/proxy/server.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/server.py b/libmproxy/proxy/server.py index 4e576067..8544ff72 100644 --- a/libmproxy/proxy/server.py +++ b/libmproxy/proxy/server.py @@ -260,11 +260,12 @@ class ConnectionHandler: sans = [] if self.server_conn.ssl_established and (not self.config.no_upstream_cert): upstream_cert = self.server_conn.cert + sans.extend(upstream_cert.altnames) if upstream_cert.cn: + sans.append(host) host = upstream_cert.cn.decode("utf8").encode("idna") - sans = upstream_cert.altnames - elif self.server_conn.sni: - sans = [self.server_conn.sni] + if self.server_conn.sni: + sans.append(self.server_conn.sni) ret = self.config.certstore.get_cert(host, sans) if not ret: -- cgit v1.2.3 From 0b7b0ac33dd8bb5d057ebc36b8979d5e3ddc0384 Mon Sep 17 00:00:00 2001 From: elitest Date: Sat, 28 Feb 2015 10:16:31 -0600 Subject: Update Config.py to improve cipher selection added support for specifying cipher suites on both sides of the proxy instead of just the one. --- libmproxy/proxy/config.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/config.py b/libmproxy/proxy/config.py index 84893323..335d2dcf 100644 --- a/libmproxy/proxy/config.py +++ b/libmproxy/proxy/config.py @@ -55,7 +55,8 @@ class ProxyConfig: self.host = host self.port = port self.server_version = server_version - self.ciphers = ciphers + self.client_ciphers = client_ciphers + self.server_ciphers = server_ciphers self.clientcerts = clientcerts self.no_upstream_cert = no_upstream_cert self.body_size_limit = body_size_limit @@ -215,9 +216,14 @@ def ssl_option_group(parser): help="Client certificate directory." ) group.add_argument( - "--ciphers", action="store", - type=str, dest="ciphers", default=None, - help="SSL cipher specification." + "--client-ciphers", action="store", + type=str, dest="client_ciphers", default=None, + help="Proxy client SSL cipher specification." + ) + group.add_argument( + "--server-ciphers", action="store", + type=str, dest="server_ciphers", default=None, + help="Proxy server SSL cipher specification." ) group.add_argument( "--cert-forward", action="store_true", @@ -248,4 +254,4 @@ def ssl_option_group(parser): metavar="PORT", help="Can be passed multiple times. Specify destination ports which are assumed to be SSL. " "Defaults to %s." % str(TRANSPARENT_SSL_PORTS) - ) \ No newline at end of file + ) -- cgit v1.2.3 From 6a1e2941496d1606f9a112cb83652e0609be31d6 Mon Sep 17 00:00:00 2001 From: elitest Date: Sat, 28 Feb 2015 11:07:18 -0600 Subject: Update Server.py to improve cipher selection Differentiated client ciphers and added server ciphers. --- libmproxy/proxy/server.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/server.py b/libmproxy/proxy/server.py index 8544ff72..7306331c 100644 --- a/libmproxy/proxy/server.py +++ b/libmproxy/proxy/server.py @@ -189,6 +189,7 @@ class ConnectionHandler: sni, method=self.config.openssl_server_method, options=self.config.openssl_server_options + cipher_list=self.config.server_ciphers, ) except tcp.NetLibError as v: e = ProxyError(502, repr(v)) @@ -210,7 +211,7 @@ class ConnectionHandler: method=self.config.openssl_client_method, options=self.config.openssl_client_options, handle_sni=self.handle_sni, - cipher_list=self.config.ciphers, + cipher_list=self.config.client_ciphers, dhparams=self.config.certstore.dhparams, chain_file=chain_file ) -- cgit v1.2.3 From b063d6020f18e8b0f3da56ebad557cec49a7ada5 Mon Sep 17 00:00:00 2001 From: Jim Shaver Date: Sun, 1 Mar 2015 20:12:27 -0600 Subject: specified cipher_list in a few more locations, added a missing comma --- libmproxy/proxy/config.py | 6 ++++-- libmproxy/proxy/server.py | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/config.py b/libmproxy/proxy/config.py index 335d2dcf..0215f92c 100644 --- a/libmproxy/proxy/config.py +++ b/libmproxy/proxy/config.py @@ -45,7 +45,8 @@ class ProxyConfig: authenticator=None, ignore_hosts=[], tcp_hosts=[], - ciphers=None, + client_ciphers=None, + server_ciphers=None, certs=[], certforward=False, ssl_version_client="secure", @@ -189,7 +190,8 @@ def process_proxy_options(parser, options): ignore_hosts=options.ignore_hosts, tcp_hosts=options.tcp_hosts, authenticator=authenticator, - ciphers=options.ciphers, + client_ciphers=options.client_ciphers, + server_ciphers=options.server_ciphers, certs=certs, certforward=options.certforward, ssl_version_client=options.ssl_version_client, diff --git a/libmproxy/proxy/server.py b/libmproxy/proxy/server.py index 7306331c..ebe91d22 100644 --- a/libmproxy/proxy/server.py +++ b/libmproxy/proxy/server.py @@ -188,7 +188,7 @@ class ConnectionHandler: self.config.clientcerts, sni, method=self.config.openssl_server_method, - options=self.config.openssl_server_options + options=self.config.openssl_server_options, cipher_list=self.config.server_ciphers, ) except tcp.NetLibError as v: -- cgit v1.2.3 From 13e74facb6b7af85cd9543ec56e01c3cd9b8270b Mon Sep 17 00:00:00 2001 From: elitest Date: Sun, 1 Mar 2015 20:21:35 -0600 Subject: Update config.py --- libmproxy/proxy/config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/config.py b/libmproxy/proxy/config.py index 0215f92c..e8c75bee 100644 --- a/libmproxy/proxy/config.py +++ b/libmproxy/proxy/config.py @@ -191,7 +191,7 @@ def process_proxy_options(parser, options): tcp_hosts=options.tcp_hosts, authenticator=authenticator, client_ciphers=options.client_ciphers, - server_ciphers=options.server_ciphers, + server_ciphers=options.server_ciphers, certs=certs, certforward=options.certforward, ssl_version_client=options.ssl_version_client, -- cgit v1.2.3 From c6f54605a72fa577ad1c968eb438f0aad8347c82 Mon Sep 17 00:00:00 2001 From: elitest Date: Sun, 1 Mar 2015 20:49:03 -0600 Subject: Update Config.py to clarify help messages --- libmproxy/proxy/config.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/config.py b/libmproxy/proxy/config.py index e8c75bee..a4765852 100644 --- a/libmproxy/proxy/config.py +++ b/libmproxy/proxy/config.py @@ -220,12 +220,12 @@ def ssl_option_group(parser): group.add_argument( "--client-ciphers", action="store", type=str, dest="client_ciphers", default=None, - help="Proxy client SSL cipher specification." + help="Client facing SSL cipher specification." ) group.add_argument( "--server-ciphers", action="store", type=str, dest="server_ciphers", default=None, - help="Proxy server SSL cipher specification." + help="Server facing SSL cipher specification." ) group.add_argument( "--cert-forward", action="store_true", -- cgit v1.2.3 From 5e07fe08ea80a860a215fe65b8430698261c7cb7 Mon Sep 17 00:00:00 2001 From: elitest Date: Mon, 2 Mar 2015 00:19:06 -0600 Subject: Update Server.py to fix SNI handling Forgot to change ciphers->client_ciphers. --- libmproxy/proxy/server.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/server.py b/libmproxy/proxy/server.py index ebe91d22..cb6d3c70 100644 --- a/libmproxy/proxy/server.py +++ b/libmproxy/proxy/server.py @@ -299,7 +299,7 @@ class ConnectionHandler: cert, key, method=self.config.openssl_client_method, options=self.config.openssl_client_options, - cipher_list=self.config.ciphers, + cipher_list=self.config.client_ciphers, dhparams=self.config.certstore.dhparams, chain_file=chain_file ) -- cgit v1.2.3 From 75ba0a92e4dd0f331505f450d6baa89b18abe2f2 Mon Sep 17 00:00:00 2001 From: Maximilian Hils Date: Mon, 2 Mar 2015 14:35:50 +0100 Subject: do some housekeeping --- libmproxy/proxy/config.py | 60 +++++++++++++++++++++++------------------------ libmproxy/proxy/server.py | 18 +++++++------- 2 files changed, 39 insertions(+), 39 deletions(-) (limited to 'libmproxy/proxy') diff --git a/libmproxy/proxy/config.py b/libmproxy/proxy/config.py index a4765852..dfde2958 100644 --- a/libmproxy/proxy/config.py +++ b/libmproxy/proxy/config.py @@ -45,8 +45,8 @@ class ProxyConfig: authenticator=None, ignore_hosts=[], tcp_hosts=[], - client_ciphers=None, - server_ciphers=None, + ciphers_client=None, + ciphers_server=None, certs=[], certforward=False, ssl_version_client="secure", @@ -56,8 +56,8 @@ class ProxyConfig: self.host = host self.port = port self.server_version = server_version - self.client_ciphers = client_ciphers - self.server_ciphers = server_ciphers + self.ciphers_client = ciphers_client + self.ciphers_server = ciphers_server self.clientcerts = clientcerts self.no_upstream_cert = no_upstream_cert self.body_size_limit = body_size_limit @@ -85,8 +85,8 @@ class ProxyConfig: for spec, cert in certs: self.certstore.add_cert_file(spec, cert) self.certforward = certforward - self.openssl_client_method, self.openssl_client_options = version_to_openssl(ssl_version_client) - self.openssl_server_method, self.openssl_server_options = version_to_openssl(ssl_version_server) + self.openssl_method_client, self.openssl_options_client = version_to_openssl(ssl_version_client) + self.openssl_method_server, self.openssl_options_server = version_to_openssl(ssl_version_server) self.ssl_ports = ssl_ports @@ -190,8 +190,8 @@ def process_proxy_options(parser, options): ignore_hosts=options.ignore_hosts, tcp_hosts=options.tcp_hosts, authenticator=authenticator, - client_ciphers=options.client_ciphers, - server_ciphers=options.server_ciphers, + ciphers_client=options.ciphers_client, + ciphers_server=options.ciphers_server, certs=certs, certforward=options.certforward, ssl_version_client=options.ssl_version_client, @@ -212,25 +212,36 @@ def ssl_option_group(parser): 'The PEM file should contain the full certificate chain, with the leaf certificate as the first entry. ' 'Can be passed multiple times.' ) + group.add_argument( + "--cert-forward", action="store_true", + dest="certforward", default=False, + help="Simply forward SSL certificates from upstream." + ) + group.add_argument( + "--ciphers-client", action="store", + type=str, dest="ciphers_client", default=None, + help="Set supported ciphers for client connections. (OpenSSL Syntax)" + ) + group.add_argument( + "--ciphers-server", action="store", + type=str, dest="ciphers_server", default=None, + help="Set supported ciphers for server connections. (OpenSSL Syntax)" + ) group.add_argument( "--client-certs", action="store", type=str, dest="clientcerts", default=None, help="Client certificate directory." ) group.add_argument( - "--client-ciphers", action="store", - type=str, dest="client_ciphers", default=None, - help="Client facing SSL cipher specification." - ) - group.add_argument( - "--server-ciphers", action="store", - type=str, dest="server_ciphers", default=None, - help="Server facing SSL cipher specification." + "--no-upstream-cert", default=False, + action="store_true", dest="no_upstream_cert", + help="Don't connect to upstream server to look up certificate details." ) group.add_argument( - "--cert-forward", action="store_true", - dest="certforward", default=False, - help="Simply forward SSL certificates from upstream." + "--ssl-port", action="append", type=int, dest="ssl_ports", default=list(TRANSPARENT_SSL_PORTS), + metavar="PORT", + help="Can be passed multiple times. Specify destination ports which are assumed to be SSL. " + "Defaults to %s." % str(TRANSPARENT_SSL_PORTS) ) group.add_argument( "--ssl-version-client", dest="ssl_version_client", @@ -246,14 +257,3 @@ def ssl_option_group(parser): help="Set supported SSL/TLS version for server connections. " "SSLv2, SSLv3 and 'all' are INSECURE. Defaults to secure." ) - group.add_argument( - "--no-upstream-cert", default=False, - action="store_true", dest="no_upstream_cert", - help="Don't connect to upstream server to look up certificate details." - ) - group.add_argument( - "--ssl-port", action="append", type=int, dest="ssl_ports", default=list(TRANSPARENT_SSL_PORTS), - metavar="PORT", - help="Can be passed multiple times. Specify destination ports which are assumed to be SSL. " - "Defaults to %s." % str(TRANSPARENT_SSL_PORTS) - ) diff --git a/libmproxy/proxy/server.py b/libmproxy/proxy/server.py index cb6d3c70..896dd024 100644 --- a/libmproxy/proxy/server.py +++ b/libmproxy/proxy/server.py @@ -187,9 +187,9 @@ class ConnectionHandler: self.server_conn.establish_ssl( self.config.clientcerts, sni, - method=self.config.openssl_server_method, - options=self.config.openssl_server_options, - cipher_list=self.config.server_ciphers, + method=self.config.openssl_method_server, + options=self.config.openssl_options_server, + cipher_list=self.config.ciphers_server, ) except tcp.NetLibError as v: e = ProxyError(502, repr(v)) @@ -208,10 +208,10 @@ class ConnectionHandler: try: self.client_conn.convert_to_ssl( cert, key, - method=self.config.openssl_client_method, - options=self.config.openssl_client_options, + method=self.config.openssl_method_client, + options=self.config.openssl_options_client, handle_sni=self.handle_sni, - cipher_list=self.config.client_ciphers, + cipher_list=self.config.ciphers_client, dhparams=self.config.certstore.dhparams, chain_file=chain_file ) @@ -297,9 +297,9 @@ class ConnectionHandler: cert, key, chain_file = self.find_cert() new_context = self.client_conn._create_ssl_context( cert, key, - method=self.config.openssl_client_method, - options=self.config.openssl_client_options, - cipher_list=self.config.client_ciphers, + method=self.config.openssl_method_client, + options=self.config.openssl_options_client, + cipher_list=self.config.ciphers_client, dhparams=self.config.certstore.dhparams, chain_file=chain_file ) -- cgit v1.2.3