aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--mitmproxy/certs.py9
-rw-r--r--mitmproxy/net/tls.py28
-rw-r--r--mitmproxy/proxy/protocol/tls.py25
-rw-r--r--mitmproxy/proxy/root_context.py2
-rw-r--r--test/mitmproxy/net/test_tls.py2
-rw-r--r--test/mitmproxy/test_connections.py2
6 files changed, 35 insertions, 33 deletions
diff --git a/mitmproxy/certs.py b/mitmproxy/certs.py
index 65dc50e4..e702e1cf 100644
--- a/mitmproxy/certs.py
+++ b/mitmproxy/certs.py
@@ -123,7 +123,7 @@ def dummy_cert(privkey, cacert, commonname, sans, organization):
)
])
cert.set_pubkey(cacert.get_pubkey())
- cert.sign(privkey, "sha256")
+ cert.sign(privkey, b"sha256")
return Cert(cert)
@@ -315,7 +315,12 @@ class CertStore:
ret.append(b"*." + b".".join(parts[i:]))
return ret
- def get_cert(self, commonname: typing.Optional[bytes], sans: typing.List[bytes], organization: typing.Optional[bytes] = None):
+ def get_cert(
+ self,
+ commonname: typing.Optional[bytes],
+ sans: typing.List[bytes],
+ organization: typing.Optional[bytes] = None
+ ) -> typing.Tuple["Cert", OpenSSL.SSL.PKey, str]:
"""
Returns an (cert, privkey, cert_chain) tuple.
diff --git a/mitmproxy/net/tls.py b/mitmproxy/net/tls.py
index 4dc61969..48392d1b 100644
--- a/mitmproxy/net/tls.py
+++ b/mitmproxy/net/tls.py
@@ -295,6 +295,17 @@ def create_client_context(
return context
+def accept_all(
+ conn_: SSL.Connection,
+ x509: SSL.X509,
+ errno: int,
+ err_depth: int,
+ is_cert_verified: bool,
+) -> bool:
+ # Return true to prevent cert verification error
+ return True
+
+
def create_server_context(
cert: typing.Union[certs.Cert, str],
key: SSL.PKey,
@@ -324,16 +335,6 @@ def create_server_context(
until then we're conservative.
"""
- def accept_all(
- conn_: SSL.Connection,
- x509: SSL.X509,
- errno: int,
- err_depth: int,
- is_cert_verified: bool,
- ) -> bool:
- # Return true to prevent cert verification error
- return True
-
if request_client_cert:
verify = SSL.VERIFY_PEER
else:
@@ -425,7 +426,7 @@ class ClientHello:
return self._client_hello.cipher_suites.cipher_suites
@property
- def sni(self):
+ def sni(self) -> typing.Optional[bytes]:
if self._client_hello.extensions:
for extension in self._client_hello.extensions.extensions:
is_valid_sni_extension = (
@@ -435,7 +436,7 @@ class ClientHello:
check.is_valid_host(extension.body.server_names[0].host_name)
)
if is_valid_sni_extension:
- return extension.body.server_names[0].host_name.decode("idna")
+ return extension.body.server_names[0].host_name
return None
@property
@@ -478,5 +479,4 @@ class ClientHello:
)
def __repr__(self):
- return "ClientHello(sni: %s, alpn_protocols: %s, cipher_suites: %s)" % \
- (self.sni, self.alpn_protocols, self.cipher_suites)
+ return f"ClientHello(sni: {self.sni}, alpn_protocols: {self.alpn_protocols})"
diff --git a/mitmproxy/proxy/protocol/tls.py b/mitmproxy/proxy/protocol/tls.py
index 096aae9f..3a60f79f 100644
--- a/mitmproxy/proxy/protocol/tls.py
+++ b/mitmproxy/proxy/protocol/tls.py
@@ -196,17 +196,14 @@ CIPHER_ID_NAME_MAP = {
}
# We manually need to specify this, otherwise OpenSSL may select a non-HTTP2 cipher by default.
-# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.2.15&openssl=1.0.2&hsts=yes&profile=old
+# https://ssl-config.mozilla.org/#config=old
DEFAULT_CLIENT_CIPHERS = (
- "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:"
- "ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:"
- "ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:"
- "ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:"
- "DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:"
- "DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:"
- "AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:"
- "HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:"
- "!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
+ b"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:"
+ b"ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:"
+ b"DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:"
+ b"ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:"
+ b"ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:"
+ b"AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
)
@@ -330,7 +327,7 @@ class TlsLayer(base.Layer):
if self._custom_server_sni is False:
return None
else:
- return self._custom_server_sni or self._client_hello and self._client_hello.sni
+ return self._custom_server_sni or self._client_hello and self._client_hello.sni.decode("idna")
@property
def alpn_for_client_connection(self):
@@ -393,9 +390,9 @@ class TlsLayer(base.Layer):
except exceptions.TlsException as e:
raise exceptions.ClientHandshakeException(
"Cannot establish TLS with client (sni: {sni}): {e}".format(
- sni=self._client_hello.sni, e=repr(e)
+ sni=self._client_hello.sni.decode("idna"), e=repr(e)
),
- self._client_hello.sni or repr(self.server_conn.address)
+ self._client_hello.sni.decode("idna") or repr(self.server_conn.address)
)
def _establish_tls_with_server(self):
@@ -493,7 +490,7 @@ class TlsLayer(base.Layer):
organization = upstream_cert.organization
# Also add SNI values.
if self._client_hello.sni:
- sans.add(self._client_hello.sni.encode("idna"))
+ sans.add(self._client_hello.sni)
if self._custom_server_sni:
sans.add(self._custom_server_sni.encode("idna"))
diff --git a/mitmproxy/proxy/root_context.py b/mitmproxy/proxy/root_context.py
index 4805f874..74a048ad 100644
--- a/mitmproxy/proxy/root_context.py
+++ b/mitmproxy/proxy/root_context.py
@@ -57,7 +57,7 @@ class RootContext:
except exceptions.TlsProtocolException as e:
self.log("Cannot parse Client Hello: %s" % repr(e), "error")
else:
- is_filtered = self.config.check_filter((client_hello.sni, 443))
+ is_filtered = self.config.check_filter((client_hello.sni.decode("idna"), 443))
if is_filtered:
return protocol.RawTCPLayer(top_layer, ignore=True)
diff --git a/test/mitmproxy/net/test_tls.py b/test/mitmproxy/net/test_tls.py
index 68e67dbe..c4e76bc6 100644
--- a/test/mitmproxy/net/test_tls.py
+++ b/test/mitmproxy/net/test_tls.py
@@ -116,7 +116,7 @@ class TestClientHello:
)
c = tls.ClientHello(data)
assert repr(c)
- assert c.sni == 'example.com'
+ assert c.sni == b'example.com'
assert c.cipher_suites == [
49195, 49199, 49196, 49200, 52393, 52392, 52244, 52243, 49161,
49171, 49162, 49172, 156, 157, 47, 53, 10
diff --git a/test/mitmproxy/test_connections.py b/test/mitmproxy/test_connections.py
index 7c371c1e..c744e621 100644
--- a/test/mitmproxy/test_connections.py
+++ b/test/mitmproxy/test_connections.py
@@ -95,7 +95,7 @@ class TestServerConnection:
def test_repr(self):
c = tflow.tserver_conn()
- c.sni = 'foobar'
+ c.sni = b'foobar'
c.tls_established = True
c.alpn_proto_negotiated = b'h2'
assert 'address:22' in repr(c)
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-31 20:49:09 +0000