8000 Make mitm work as a transparent proxy by shosti · Pull Request #2 · kr/mitm · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Make mitm work as a transparent proxy #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 14 commits into
base: master
Choose a base branch
from
Open

Make mitm work as a transparent proxy #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
ae809f9
Add caching for certificates, makes things much faster.
ukd1 May 1, 2015
c0a8f84
mitm: break out tls stuff so we can share with a Listener
bmizerany Jun 9, 2015
3a9fec2
mitm: use self-signed RootCAs for valid verify tests
bmizerany Jun 9, 2015
32b7f10
mitm: NewListener for transparent proxies
bmizerany Jun 10, 2015
d95d106
mitm: docs
bmizerany Jun 10, 2015
ee8a9e8
Fix tests
shosti Jul 9, 2015
ffd8559
Merge branch 'master' into breakout
shosti Jul 9, 2015
3b84b00
Fix minor issue found by go vet
shosti Jul 9, 2015
c73d3e1
Remove dead code
shosti Jul 9, 2015
490537a
Merge pull request #1 from rainforestapp/breakout
ukd1 Jul 9, 2015
28f7eb1
Parameterize proxy director
shosti Aug 6, 2015
cf46fe1
Merge pull request #2 from rainforestapp/director
shosti Aug 8, 2015
14a59fa
Cache certificates to avoid unnecessary generation
shosti Aug 8, 2015
dc4a316
Merge pull request #4 from rainforestapp/cache
shosti Aug 8, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
*.pem
91 changes: 51 additions & 40 deletions cert.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
"errors"
"fmt"
"math/big"
"net"
"time"
)

Expand All @@ -27,46 +28,8 @@ const (
leafUsage = caUsage
)

func genCert(ca *tls.Certificate, names []string) (*tls.Certificate, error) {
now := time.Now().Add(-1 * time.Hour).UTC()
if !ca.Leaf.IsCA {
return nil, errors.New("CA cert is not a CA")
}
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
if err != nil {
return nil, fmt.Errorf("failed to generate serial number: %s", err)
}
tmpl := &x509.Certificate{
SerialNumber: serialNumber,
Subject: pkix.Name{CommonName: names[0]},
NotBefore: now,
NotAfter: now.Add(leafMaxAge),
KeyUsage: leafUsage,
BasicConstraintsValid: true,
DNSNames: names,
SignatureAlgorithm: x509.ECDSAWithSHA512,
}
key, err := genKeyPair()
if err != nil {
return nil, err
}
x, err := x509.CreateCertificate(rand.Reader, tmpl, ca.Leaf, key.Public(), ca.PrivateKey)
if err != nil {
return nil, err
}
cert := new(tls.Certificate)
cert.Certificate = append(cert.Certificate, x)
cert.PrivateKey = key
cert.Leaf, _ = x509.ParseCertificate(x)
return cert, nil
}

func genKeyPair() (*ecdsa.PrivateKey, error) {
return ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
}

func GenCA(name string) (certPEM, keyPEM []byte, err error) {
// GenerateCA generates a CA cert and key pair.
func GenerateCA(name string) (certPEM, keyPEM []byte, err error) {
now := time.Now().UTC()
tmpl := &x509.Certificate{
SerialNumber: big.NewInt(1),
Expand Down Expand Up @@ -101,3 +64,51 @@ func GenCA(name string) (certPEM, keyPEM []byte, err error) {
})
return
}

// GenerateCert generates a leaf cert from ca.
func GenerateCert(ca *tls.Certificate, hosts ...string) (*tls.Certificate, error) {
now := time.Now().Add(-1 * time.Hour).UTC()
if !ca.Leaf.IsCA {
return nil, errors.New("CA cert is not a CA")
}
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
if err != nil {
return nil, fmt.Errorf("failed to generate serial number: %s", err)
}
template := &x509.Certificate{
SerialNumber: serialNumber,
Subject: pkix.Name{CommonName: hosts[0]},
NotBefore: now,
NotAfter: now.Add(leafMaxAge),
KeyUsage: leafUsage,
BasicConstraintsValid: true,
SignatureAlgorithm: x509.ECDSAWithSHA512,
}

for _, h := range hosts {
if ip := net.ParseIP(h); ip != nil {
template.IPAddresses = append(template.IPAddresses, ip)
} else {
template.DNSNames = append(template.DNSNames, h)
}
}

key, err := genKeyPair()
if err != nil {
return nil, err
}
x, err := x509.CreateCertificate(rand.Reader, template, ca.Leaf, key.Public(), ca.PrivateKey)
if err != nil {
return nil, err
}
cert := new(tls.Certificate)
cert.Certificate = append(cert.Certificate, x)
cert.PrivateKey = key
cert.Leaf, _ = x509.ParseCertificate(x)
return cert, nil
}

func genKeyPair() (*ecdsa.PrivateKey, error) {
return ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
}
261 changes: 261 additions & 0 deletions cert_test.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
0