Grasscutters/mitmproxy
3
0
Fork 0
mirror of https://github.com/Grasscutters/mitmproxy.git synced 2024-11-23 00:01:36 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #1738 from Kriechi/fix-1737

Browse Source 
restrict ALPN offers if host changes
This commit is contained in:
Aldo Cortesi 2016-11-14 08:50:29 +13:00 committed by GitHub
commit 2d0a65a3f4
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
mitmproxy/proxy/protocol/tls.py
View File

@ -432,7 +432,6 @@ class TlsLayer(base.Layer):
def __alpn_select_callback(self, conn_, options): def __alpn_select_callback(self, conn_, options):
# This gets triggered if we haven't established an upstream connection yet. # This gets triggered if we haven't established an upstream connection yet.
default_alpn = b'http/1.1' default_alpn = b'http/1.1'
# alpn_preference = b'h2'
if self.alpn_for_client_connection in options: if self.alpn_for_client_connection in options:
choice = bytes(self.alpn_for_client_connection) choice = bytes(self.alpn_for_client_connection)
@ -504,6 +503,17 @@ class TlsLayer(base.Layer):
if alpn and b"h2" in alpn and not self.config.options.http2: if alpn and b"h2" in alpn and not self.config.options.http2:
alpn.remove(b"h2") alpn.remove(b"h2")
if self.client_conn.ssl_established:
# If the client has already negotiated an ALP, then force the
# server to use the same. This can only happen if the host gets
# changed after the initial connection was established. E.g.:
# * the client offers http/1.1 and h2,
# * the initial host is only capable of http/1.1,
# * then the first server connection negotiates http/1.1,
# * but after the server_conn change, the new host offers h2
# * which results in garbage because the layers don' match.
alpn = [self.client_conn.connection.get_alpn_proto_negotiated()]
ciphers_server = self.config.options.ciphers_server ciphers_server = self.config.options.ciphers_server
if not ciphers_server and self._client_tls: if not ciphers_server and self._client_tls:
ciphers_server = [] ciphers_server = []