Commit: 121f3e090a645baec25b19239242ab91e7617aee - sslsniff-deb (git)

Commit MetaInfo

• Revisión: 121f3e090a645baec25b19239242ab91e7617aee (tree)
• Tiempo: 2021-11-21 21:33:54
• Autor: dyknon <dyknon@user...>
• Commiter: dyknon

Log Message

SNI support

Cambiar Resumen

• modified: debian/patches/Add-SNI-support.patch

Diferencia incremental

--- a/debian/patches/Add-SNI-support.patch
+++ b/debian/patches/Add-SNI-support.patch
@@ -3,12 +3,12 @@ Date: Sun, 21 Nov 2021 18:48:30 +0900
 Subject: Add SNI support
 
 ---
- SSLBridge.cpp | 52 +++++++++++++++++++++++++++-------------------------
- SSLBridge.hpp |  3 ++-
- 2 files changed, 29 insertions(+), 26 deletions(-)
+ SSLBridge.cpp | 84 +++++++++++++++++++++++++++++++++++++----------------------
+ SSLBridge.hpp |  7 ++++-
+ 2 files changed, 59 insertions(+), 32 deletions(-)
 
 diff --git a/SSLBridge.cpp b/SSLBridge.cpp
-index b9259ad..832adc7 100644
+index b9259ad..93f2b7c 100644
 --- a/SSLBridge.cpp
 +++ b/SSLBridge.cpp
 @@ -26,15 +26,13 @@ X509* SSLBridge::getServerCertificate() {
@@ -51,42 +51,72 @@ index b9259ad..832adc7 100644
    SSL_CTX_set_mode(context, SSL_MODE_AUTO_RETRY);
  }
  
-@@ -71,18 +70,30 @@ void SSLBridge::setServerName() {
+@@ -70,32 +69,64 @@ void SSLBridge::setServerName() {
+   free(serverNameStr);
  }
  
++int SSLBridge::cert_cb(SSL *ssl, void *self){
++  ((SSLBridge *)self)->setupServerCert();
++  return 1;
++}
++
  void SSLBridge::handshakeWithClient(CertificateManager &manager, bool wildcardOK) {
+-  Certificate *leaf;
+-  std::list<Certificate*> *chain;
 +  ip::address_v4 serverAddress = serverSocket->remote_endpoint().address().to_v4();
-   Certificate *leaf;
-   std::list<Certificate*> *chain;
- 
-+  /* Server handshake */
-+  if (SSL_connect(serverSession) < 0) {
-+    Logger::logError("Error on SSL Connect.");
-+    throw SSLConnectionError();
-+  }
-+  cache->setNewSessionId(serverSession, SSL_get1_session(serverSession), 
-+			 serverAddress.to_bytes().data(), 
-+			 serverAddress.to_bytes().size());
++  this->wildcardOK = wildcardOK;
++  this->certman = &manager;
 +
 +  /* Client handhake */
-   ip::tcp::endpoint endpoint = getRemoteEndpoint();
-   manager.getCertificateForTarget(endpoint, wildcardOK, getServerCertificate(), &leaf, &chain);
+ 
+-  ip::tcp::endpoint endpoint = getRemoteEndpoint();
+-  manager.getCertificateForTarget(endpoint, wildcardOK, getServerCertificate(), &leaf, &chain);
 -  
-+
-   setServerName();
+-  setServerName();
 -  
-+
    SSL_CTX *clientContext = SSL_CTX_new(SSLv23_server_method());
 -  buildClientContext(clientContext, leaf, chain);
 +  buildClientContext(clientContext);
++  SSL_CTX_set_cert_cb(clientContext, SSLBridge::cert_cb, this);
  
    SSL *clientSession = SSL_new(clientContext);
-+  useCertkey(clientSession, leaf, chain);
++  this->clientSession = clientSession;
    SSL_set_fd(clientSession, clientSocket->native_handle());
  
    if (SSL_accept(clientSession) == 0) {
-@@ -93,9 +104,9 @@ void SSLBridge::handshakeWithClient(CertificateManager &manager, bool wildcardOK
-   this->clientSession = clientSession;
+     Logger::logError("SSL Accept Failed!");
+     throw SSLConnectionError();
+   }
++  setServerName();
++}
+ 
+-  this->clientSession = clientSession;
++void SSLBridge::setupServerCert(){
++  ip::address_v4 serverAddress = serverSocket->remote_endpoint().address().to_v4();
++  ip::tcp::endpoint endpoint = getRemoteEndpoint();
++  Certificate *leaf;
++  std::list<Certificate*> *chain;
++
++  /* handle SNI */
++  int sntype = SSL_get_servername_type(clientSession);
++  if(sntype == TLSEXT_NAMETYPE_host_name){
++    const char *sname = SSL_get_servername(clientSession, sntype);
++    SSL_set_tlsext_host_name(serverSession, sname);
++  }
++
++  /* Server handshake */
++  if (SSL_connect(serverSession) < 0) {
++    Logger::logError("Error on SSL Connect.");
++    throw SSLConnectionError();
++  }
++  cache->setNewSessionId(serverSession, SSL_get1_session(serverSession), 
++			 serverAddress.to_bytes().data(), 
++			 serverAddress.to_bytes().size());
++
++  /* Generate and set certificate */
++  certman->getCertificateForTarget(
++    endpoint, wildcardOK, getServerCertificate(), &leaf, &chain);
++  useCertkey(clientSession, leaf, chain);
  }
  
 +/* Do not start TLS handshake: to support SNI */
@@ -96,7 +126,7 @@ index b9259ad..832adc7 100644
    ip::address_v4 serverAddress = serverSocket->remote_endpoint().address().to_v4();
    SSL_CTX *serverCtx           = SSL_CTX_new(SSLv23_client_method());;
    SSL *serverSession           = SSL_new(serverCtx);;
-@@ -112,15 +123,6 @@ void SSLBridge::handshakeWithServer() {
+@@ -112,15 +143,6 @@ void SSLBridge::handshakeWithServer() {
    SSL_set_connect_state(serverSession);
    SSL_set_fd(serverSession, serverSocket->native_handle());
    SSL_set_options(serverSession, SSL_OP_ALL);
@@ -113,16 +143,23 @@ index b9259ad..832adc7 100644
    this->serverSession = serverSession;
  }
 diff --git a/SSLBridge.hpp b/SSLBridge.hpp
-index 753bd4e..d871c2f 100644
+index 753bd4e..82a44a2 100644
 --- a/SSLBridge.hpp
 +++ b/SSLBridge.hpp
-@@ -99,7 +99,8 @@ private:
+@@ -98,10 +98,15 @@ private:
+   struct pollfd *pfds;
    std::optional<Lane> lanes[2];
  
++  bool wildcardOK;
++  CertificateManager *certman;
    X509* getServerCertificate();
 -  void buildClientContext(SSL_CTX *context, Certificate *leaf, std::list<Certificate*> *chain);
 +  void buildClientContext(SSL_CTX *context);
 +  void useCertkey(SSL *context, Certificate *leaf, std::list<Certificate*> *chain);
++  void setupServerCert();
    int forwardData(SSL *from, SSL *to);
    void setServerName();
++  static int cert_cb(SSL *ssl, void *self);
+ 
+ public: