From 6fb706ec150315178b402ad1f3afe316c8c92aa8 Mon Sep 17 00:00:00 2001 From: Thomas Kriechbaumer Date: Sun, 13 Nov 2016 12:11:56 +0100 Subject: [PATCH] restrict ALPN offers if host changes --- mitmproxy/proxy/protocol/tls.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mitmproxy/proxy/protocol/tls.py b/mitmproxy/proxy/protocol/tls.py index 796477b21..1cb9b3c25 100644 --- a/mitmproxy/proxy/protocol/tls.py +++ b/mitmproxy/proxy/protocol/tls.py @@ -432,7 +432,6 @@ class TlsLayer(base.Layer): def __alpn_select_callback(self, conn_, options): # This gets triggered if we haven't established an upstream connection yet. default_alpn = b'http/1.1' - # alpn_preference = b'h2' if self.alpn_for_client_connection in options: choice = bytes(self.alpn_for_client_connection) @@ -504,6 +503,17 @@ class TlsLayer(base.Layer): if alpn and b"h2" in alpn and not self.config.options.http2: alpn.remove(b"h2") + if self.client_conn.ssl_established: + # If the client has already negotiated an ALP, then force the + # server to use the same. This can only happen if the host gets + # changed after the initial connection was established. E.g.: + # * the client offers http/1.1 and h2, + # * the initial host is only capable of http/1.1, + # * then the first server connection negotiates http/1.1, + # * but after the server_conn change, the new host offers h2 + # * which results in garbage because the layers don' match. + alpn = [self.client_conn.connection.get_alpn_proto_negotiated()] + ciphers_server = self.config.options.ciphers_server if not ciphers_server and self._client_tls: ciphers_server = []