提交: 9b16264f78e72d0a9ffbfbc7e67c26830b149e69 - sslsniff-deb (git)

Commit MetaInfo

• 修订版: 9b16264f78e72d0a9ffbfbc7e67c26830b149e69 (tree)
• 时间: 2021-11-21 18:59:29
• 作者: dyknon <dyknon@user...>
• Commiter: dyknon

Log Message

SNI support inprogress

更改概述

• modified: debian/patches/4debug.patch
• add: debian/patches/Add-SNI-support.patch
• modified: debian/patches/series

差异

--- a/debian/patches/4debug.patch
+++ b/debian/patches/4debug.patch
@@ -7,7 +7,7 @@ Subject: 4debug
  1 file changed, 31 insertions(+)
 
 diff --git a/certificate/AuthorityCertificateManager.cpp b/certificate/AuthorityCertificateManager.cpp
-index 567367b..e3e8d4e 100644
+index d89dafb..4f3afa0 100644
 --- a/certificate/AuthorityCertificateManager.cpp
 +++ b/certificate/AuthorityCertificateManager.cpp
 @@ -19,6 +19,8 @@
@@ -19,7 +19,7 @@ index 567367b..e3e8d4e 100644
  
  AuthorityCertificateManager::AuthorityCertificateManager(std::string &file, std::string &chain) {
    path certPath(file);
-@@ -74,6 +76,35 @@ void AuthorityCertificateManager::getCertificateForTarget(boost::asio::ip::tcp::
+@@ -133,6 +135,35 @@ void AuthorityCertificateManager::getCertificateForTarget(boost::asio::ip::tcp::
  
    X509_sign(request, authority->getKey(), EVP_sha256());
  

--- /dev/null
+++ b/debian/patches/Add-SNI-support.patch
@@ -0,0 +1,128 @@
+From: dyknon <[e-mail]>
+Date: Sun, 21 Nov 2021 18:48:30 +0900
+Subject: Add SNI support
+
+---
+ SSLBridge.cpp | 52 +++++++++++++++++++++++++++-------------------------
+ SSLBridge.hpp |  3 ++-
+ 2 files changed, 29 insertions(+), 26 deletions(-)
+
+diff --git a/SSLBridge.cpp b/SSLBridge.cpp
+index b9259ad..832adc7 100644
+--- a/SSLBridge.cpp
++++ b/SSLBridge.cpp
+@@ -26,15 +26,13 @@ X509* SSLBridge::getServerCertificate() {
+   return SSL_get_peer_certificate(serverSession);
+ }
+ 
+-void SSLBridge::buildClientContext(SSL_CTX *context, Certificate *leaf, std::list<Certificate*> *chain) {
++void SSLBridge::useCertkey(
++    SSL *ssl, Certificate *leaf, std::list<Certificate*> *chain
++){
++  SSL_use_certificate(ssl, leaf->getCert());
++  SSL_use_PrivateKey(ssl, leaf->getKey());
+ 
+-  SSL_CTX_sess_set_new_cb(context, &SessionCache::setNewSessionIdTramp);
+-  SSL_CTX_sess_set_get_cb(context, &SessionCache::getSessionIdTramp);
+-
+-  SSL_CTX_use_certificate(context, leaf->getCert());
+-  SSL_CTX_use_PrivateKey(context, leaf->getKey());
+-
+-  if (SSL_CTX_check_private_key(context) == 0) {
++  if (SSL_check_private_key(ssl) == 0) {
+     std::cerr << "*** Assertion Failed - Generated PrivateKey Doesn't Work." << std::endl;
+     throw SSLConnectionError();
+   }
+@@ -43,12 +41,13 @@ void SSLBridge::buildClientContext(SSL_CTX *context, Certificate *leaf, std::lis
+   std::list<Certificate*>::iterator end = chain->end();
+ 
+   for (;i != end; i++) {
+-    SSL_CTX_add_extra_chain_cert(context, (*i)->getCert());
++    SSL_add1_chain_cert(ssl, (*i)->getCert());
+   }
++}
+ 
+-  // if (chain != NULL)
+-  //   SSL_CTX_add_extra_chain_cert(context, chain->getCert());
+-
++void SSLBridge::buildClientContext(SSL_CTX *context) {
++  SSL_CTX_sess_set_new_cb(context, &SessionCache::setNewSessionIdTramp);
++  SSL_CTX_sess_set_get_cb(context, &SessionCache::getSessionIdTramp);
+   SSL_CTX_set_mode(context, SSL_MODE_AUTO_RETRY);
+ }
+ 
+@@ -71,18 +70,30 @@ void SSLBridge::setServerName() {
+ }
+ 
+ void SSLBridge::handshakeWithClient(CertificateManager &manager, bool wildcardOK) {
++  ip::address_v4 serverAddress = serverSocket->remote_endpoint().address().to_v4();
+   Certificate *leaf;
+   std::list<Certificate*> *chain;
+ 
++  /* Server handshake */
++  if (SSL_connect(serverSession) < 0) {
++    Logger::logError("Error on SSL Connect.");
++    throw SSLConnectionError();
++  }
++  cache->setNewSessionId(serverSession, SSL_get1_session(serverSession), 
++			 serverAddress.to_bytes().data(), 
++			 serverAddress.to_bytes().size());
++
++  /* Client handhake */
+   ip::tcp::endpoint endpoint = getRemoteEndpoint();
+   manager.getCertificateForTarget(endpoint, wildcardOK, getServerCertificate(), &leaf, &chain);
+-  
++
+   setServerName();
+-  
++
+   SSL_CTX *clientContext = SSL_CTX_new(SSLv23_server_method());
+-  buildClientContext(clientContext, leaf, chain);
++  buildClientContext(clientContext);
+ 
+   SSL *clientSession = SSL_new(clientContext);
++  useCertkey(clientSession, leaf, chain);
+   SSL_set_fd(clientSession, clientSocket->native_handle());
+ 
+   if (SSL_accept(clientSession) == 0) {
+@@ -93,9 +104,9 @@ void SSLBridge::handshakeWithClient(CertificateManager &manager, bool wildcardOK
+   this->clientSession = clientSession;
+ }
+ 
++/* Do not start TLS handshake: to support SNI */
+ void SSLBridge::handshakeWithServer() {
+   int bogus;
+-
+   ip::address_v4 serverAddress = serverSocket->remote_endpoint().address().to_v4();
+   SSL_CTX *serverCtx           = SSL_CTX_new(SSLv23_client_method());;
+   SSL *serverSession           = SSL_new(serverCtx);;
+@@ -112,15 +123,6 @@ void SSLBridge::handshakeWithServer() {
+   SSL_set_connect_state(serverSession);
+   SSL_set_fd(serverSession, serverSocket->native_handle());
+   SSL_set_options(serverSession, SSL_OP_ALL);
+-  
+-  if (SSL_connect(serverSession) < 0) {
+-    Logger::logError("Error on SSL Connect.");
+-    throw SSLConnectionError();
+-  }
+-
+-  cache->setNewSessionId(serverSession, SSL_get1_session(serverSession), 
+-			 serverAddress.to_bytes().data(), 
+-			 serverAddress.to_bytes().size());
+ 
+   this->serverSession = serverSession;
+ }
+diff --git a/SSLBridge.hpp b/SSLBridge.hpp
+index 753bd4e..d871c2f 100644
+--- a/SSLBridge.hpp
++++ b/SSLBridge.hpp
+@@ -99,7 +99,8 @@ private:
+   std::optional<Lane> lanes[2];
+ 
+   X509* getServerCertificate();
+-  void buildClientContext(SSL_CTX *context, Certificate *leaf, std::list<Certificate*> *chain);
++  void buildClientContext(SSL_CTX *context);
++  void useCertkey(SSL *context, Certificate *leaf, std::list<Certificate*> *chain);
+   int forwardData(SSL *from, SSL *to);
+   void setServerName();
+ 

--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,3 +7,4 @@ Fix-FTBFS-with-Boost-1.71.patch
 fix_FTBFS_boost174.patch
 all-fixs.patch
 4debug.patch
+Add-SNI-support.patch