ProxHTTPSProxyMII: Reloaded

[JJoe]

(May. 09, 2018 04:09 PM)ryszardzonk Wrote:  So it seems on the first try ProxHTTPSProxyMII saves required certificate but does not use it and sets up proper connection on the next try when it already has required certificate on the disk... uffff...

Anyways and awaiting that fix for using certificate the first time too

I haven't noticed this. I have rarely seen the connection timing out before the address is resolved on the first visit. The cached certificate might help but it has been too rare to study.
When this happens on Windows the ProxHTTPSProxyMII log shows something like

Quote:(Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x05C67630>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed',))

This is more of a missing feature of urllib3 than a bug. The time limit can be increased.

(May. 09, 2018 04:09 PM)ryszardzonk Wrote:  It might be that squid by doing its own ssl mangling somehow will not work with ProxHTTPSProxyMII which does recreate ssl certificates too. Maybe the solution could be installing that CA.crt somewhere in the system for squid?

Browser>>ProxHTTPSProxyMII front>>Privoxy>>ProxHTTPSProxyMII Rear>>Squid

Assuming that you haven't disabled verification in ProxHTTPSProxyMII, did you add Squid's certificate to ProxHTTPSProxyMII certificate store (cacert.pem), like you added ProxHTTPSProxyMII's to the browser's?

If the chain is as above, you could disable verification in ProxHTTPSProxyMII and certificate creation in Squid. Then ProxHTTPSProxyMII would hide the mitm from the browser and Squid would verify the site's certificates.

(May. 09, 2018 04:09 PM)ryszardzonk Wrote:  EDIT2:
I tried like 100 different combinations for squid-3.5.27 parent proxy cache_peer & sslproxy_flags which would help accepting ssl connection from ProxHTTPSProxyMII to squid like

Code:

sslflags=DONT_VERIFY_PEER,DONT_VERIFY_DOMAIN
sslcapath=/opt/proxhttpsproxy/
sslcafile=/opt/proxhttpsproxy/proxhttpsproxy.pem (CA.crt file without private key)

What about:

Code:

sslcipher=...    The list of valid SSL ciphers to use when connecting
            to this peer.
    
ssloptions=...     Specify various SSL implementation options:

                NO_SSLv2    Disallow the use of SSLv2
                NO_SSLv3    Disallow the use of SSLv3
                NO_TLSv1    Disallow the use of TLSv1.0
                NO_TLSv1_1  Disallow the use of TLSv1.1
                NO_TLSv1_2  Disallow the use of TLSv1.2

                SINGLE_DH_USE
                      Always create a new key when using
                      temporary/ephemeral DH key exchanges

                NO_TICKET
                      Disable use of RFC5077 session tickets. Some servers
                      may have problems understanding the TLS extension due
                      to ambiguous specification in RFC4507.

                ALL       Enable various bug workarounds
                      suggested as "harmless" by OpenSSL
                      Be warned that this reduces SSL/TLS
                      strength to some attacks.

            See the OpenSSL SSL_CTX_set_options documentation for a
            more complete list.

Because, the errors below seem to show a failure to match protocols and/or cyphers.
https://www.ssllabs.com/ssltest/viewMyClient.html may help.

(May. 09, 2018 04:09 PM)ryszardzonk Wrote:  

Code:

2018/05/10 19:25:18 kid1| Error negotiating SSL on FD 12: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol (1/-1/0)
2018/05/10 19:25:18 kid1| TCP connection to 127.0.0.1/3129 failed
...

while response from ProxHTTPSProxyMII to squids request looked as follows

Code:

127.0.0.1 - - [10/May/2018 20:02:06] code 400, message Bad request syntax ('\x16\x03\x01\x013\x01\x00\x01/\x03\x03¡1d\xad¿²\x81C¯\x0f{\x8câøÛÑxñ\x94úc3y\x97î²xå=Ü-\x87\x00\x00¬À0À,À(À$À\x14À')
...

(May. 09, 2018 04:09 PM)ryszardzonk Wrote:  Is it even possible to connect the two together?

Probably

JJoe Wrote:I think I understand but I haven't actually done it.
So...