mirror of https://github.com/vee1e/mitmproxy.git synced 2026-09-05 12:17:21 +00:00

mirror of https://github.com/vee1e/mitmproxy - An interactive TLS-capable intercepting HTTP proxy for penet

Find a file

Mike Anselmi 3ba4b65ecd Fix ca_file containing multiple CAs (#6666 ) #### Description Unfortunately `0b5e310881` broke mitmproxy's ability to issue leaf certificates if `ca_file` contains multiple CAs. This PR restores that capability. The issue lies in `mitmproxy/certs.py` - specifically, in the `from_files` method of the `CertStore` class. Before `0b5e310881`, the issuing CA was identified like this: ``` python raw = ca_file.read_bytes() key = load_pem_private_key(raw, passphrase) … certs = re.split(rb"(?=-----BEGIN CERTIFICATE-----)", raw) ca = Cert.from_pem(certs[1]) ``` This worked even when `ca_file` contained multiple CAs. For example, consider this example: ``` -----BEGIN PRIVATE KEY----- REDACTED -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIICmTCCAfqgAwIBAgIRAIqaBJ6aU5wXT+5JAn8Uj1IwCgYIKoZIzj0EAwQwMDEu MCwGA1UEAxMlbWFuc2VsbWkgSW50ZXJtZWRpYXRlIENBICgyMDIzLTA0LTExKTAe Fw0yNDAyMTQxNzEzMDBaFw0yNDAyMTUxNzE0MDBaMB8xHTAbBgNVBAMTFG1pdG1w cm94eSBJc3N1aW5nIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEeKTLpy6KeiWN 89S9UJoTM9w6HyrEiVByf/ie2wUX3vR/3nHVMTi5XZQD6/8h3A9yUWwtRtVDj55D STbPKjN6G8t/Qh1dGz2vanNjmWNlceM3DOIlT30vmR5+GrUOwj+7o4HoMIHlMA4G A1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYD VR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUkf9kgx5DbP0B66Ir6oLUDV/CIU4w HwYDVR0jBBgwFoAUqBYQLb8rkIidwq5dYuiDFdKhY48wYAYMKwYBBAGCpGTGKEAB BFAwTgIBAQQcbWlrZUBtYW5zZWxtaS5jb206aXNzdWluZy1jYQQrYmZhODBJaGMz VXNUcU0yQlp6ZG1rYW1OLW1XNGtpWTJrM1g5X19kd3Q0bzAKBggqhkjOPQQDBAOB jAAwgYgCQgF/QLZ0cThJKeoeIk4dY4+Z2MdIey7kvvy1jwlWrsOqOY+UXUWHXRlj oXZN92imAKqgLU5T859MMqWrjA1LjN7w6QJCAY+2xN7ovry3WSMqwnu86NuPL8vh fjftZeIW5GWuLzOsEFt7SfWMhkmFc/jcFpZ/qlolPhvr6E170zNhHUSMKvjb -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIICcjCCAdSgAwIBAgIQeK+VyMjx85py1kqGdjn5nTAKBggqhkjOPQQDBDAoMSYw JAYDVQQDEx1tYW5zZWxtaSBSb290IENBICgyMDIzLTA0LTExKTAeFw0yMzA0MTEw MjIzMzdaFw0yODA0MDkwMjIzMzdaMDAxLjAsBgNVBAMTJW1hbnNlbG1pIEludGVy bWVkaWF0ZSBDQSAoMjAyMy0wNC0xMSkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA BADhbjtnME8IDpBab8MogM0HchH0V9B8Qx7nRXK+tbGyyHlgLjIBYF/erJGBP0md RMAxU5x/nPlHPODRBkJhB0wbcwGC9zjQQyxfhG75806QzkaZSsC0kFZ9d3JG4fjn uenY1S2VZ5qE0gDc8Qmfyjcx7KqxQKwS9RwtG1ymAmWgvmGIJ6OBlDCBkTAOBgNV HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqBYQLb8r kIidwq5dYuiDFdKhY48wHwYDVR0jBBgwFoAU6+JptrrPiOuWZyKvwg0EJz5TkW8w KwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2NhLm1hbnNlbG1pLmNvbS9jcmwwCgYI KoZIzj0EAwQDgYsAMIGHAkEw/A2kiL4Kt9/8PND89vlXEehqeymFgats62a3UMU2 g3zATES/WI2E1IgqIsmB6ILRgWMslzpH+NGP+JJkFCz9cwJCAJaRlnOc3xafHZta 0Xwr5YUVAAfmVOj9a2XAsNlNuMy2t8cmeeGmQjrZwCuivlzLOp19Ge3Mi0dnzeV+ 5L2rBOCL -----END CERTIFICATE----- ``` `certs` would have three elements: the private key, the issuing CA and the intermediate CA. As a result, `ca = Cert.from_pem(certs[1])` would select the first CA (the issuing CA). From `0b5e310881` onward, we instead have ``` python raw = ca_file.read_bytes() key = load_pem_private_key(raw, passphrase) … certs = x509.load_pem_x509_certificates(raw) ca = Cert(certs[-1]) ``` Now, `certs` would have only two elements: the issuing CA and the intermediate CA. (`x509.load_pem_x509_certificates` discards the private key.) As a result, `ca = Cert(certs[-1])` must instead be `ca = Cert(certs[0])`, otherwise the `ca` and `key` won't correspond to each other and we'll eventually see an error like this when mitmproxy tries to generate a leaf certificate: ``` Addon error: [('x509 certificate routines', '', 'key values mismatch')] Traceback (most recent call last): File "/Users/manselmi/repos/mitmproxy/mitmproxy/addons/tlsconfig.py", line 208, in tls_start_client tls_start.ssl_conn.use_privatekey( File "/Users/manselmi/virtualenv/mitmproxy-py312/lib/python3.12/site-packages/OpenSSL/SSL.py", line 1949, in use_privatekey self._context._raise_passphrase_exception() File "/Users/manselmi/virtualenv/mitmproxy-py312/lib/python3.12/site-packages/OpenSSL/SSL.py", line 1123, in _raise_passphrase_exception _raise_current_error() File "/Users/manselmi/virtualenv/mitmproxy-py312/lib/python3.12/site-packages/OpenSSL/_util.py", line 57, in exception_from_error_queue raise exception_type(errors) OpenSSL.SSL.Error: [('x509 certificate routines', '', 'key values mismatch')] ```		2024-02-16 19:37:24 +00:00
.github	Bump the github-actions group with 2 updates (#6638 )	2024-02-01 22:43:05 +00:00
docs	docs: Rosetta is required on Apple Silicon (#6591 )	2024-01-08 22:02:43 +00:00
examples	remove leftover command line switch	2024-01-29 08:35:37 +01:00
mitmproxy	Fix ca_file containing multiple CAs (#6666 )	2024-02-16 19:37:24 +00:00
release	implement UDP streams (#6557 )	2024-01-04 10:53:13 +01:00
test	Make tests pass on older OpenSSL (#6665 )	2024-02-15 21:49:19 +00:00
web	add svg image preview support (#6551 )	2023-12-13 09:20:03 +01:00
.gitattributes
.gitignore	update kaitai definitions	2022-07-29 16:13:15 +02:00
CHANGELOG.md	Fix ca_file containing multiple CAs (#6666 )	2024-02-16 19:37:24 +00:00
codecov.yml	remove `release/` from coverage	2022-07-25 01:39:04 +02:00
CONTRIBUTING.md	CONTRIBUTING.md: temporarily remove `--cov`	2023-12-02 08:37:37 +07:00
LICENSE
MANIFEST.in
pyproject.toml	Fix error message in OpenSSL >=3.2.0 (#6658 )	2024-02-13 16:28:00 +01:00
README.md	Remove Links to Slack Workspace (#6560 )	2023-12-19 12:20:43 +00:00
SECURITY.md	Create SECURITY.md	2021-09-13 16:34:33 +02:00
setup.cfg	Migrate to ruff (#6433 )	2023-10-31 16:03:53 +01:00