
    kj&l                     P   d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dlm
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z" d dl!m#Z# d dl!mZ$  ejJ                  e&      Z'dZ(dge(Z)dejT                  de+e,df   fdZ-ej\                  j^                   e0ej\                  dd       z  Z1 G d de      Z2dejf                  de4e5   de	fdZ6 G d  d!      Z7d"e,dejp                  fd#Z9y)$    N)Path)Any)Literal)	TypedDict)H3_ALPN)CipherSuite)x509)SSL)certs)
connection)ctx)
exceptions)http)tls)CONF_BASENAME)context)modes)quic)zECDHE-ECDSA-AES128-GCM-SHA256zECDHE-RSA-AES128-GCM-SHA256zECDHE-ECDSA-AES256-GCM-SHA384zECDHE-RSA-AES256-GCM-SHA384zECDHE-ECDSA-CHACHA20-POLY1305zECDHE-RSA-CHACHA20-POLY1305zDHE-RSA-AES128-GCM-SHA256zDHE-RSA-AES256-GCM-SHA384zDHE-RSA-CHACHA20-POLY1305zECDHE-ECDSA-AES128-SHA256zECDHE-RSA-AES128-SHA256zECDHE-ECDSA-AES128-SHAzECDHE-RSA-AES128-SHAzECDHE-ECDSA-AES256-SHA384zECDHE-RSA-AES256-SHA384zECDHE-ECDSA-AES256-SHAzECDHE-RSA-AES256-SHAzDHE-RSA-AES128-SHA256zDHE-RSA-AES256-SHA256zAES128-GCM-SHA256zAES256-GCM-SHA384zAES128-SHA256zAES256-SHA256z
AES128-SHAz
AES256-SHAzDES-CBC3-SHA@SECLEVEL=0min_tls_versionreturn.c                 >    | t         j                  v rt        S t        S )zz
    @SECLEVEL=0 is necessary for TLS 1.1 and below to work,
    see https://github.com/pyca/cryptography/issues/9523
    )net_tlsINSECURE_TLS_MIN_VERSIONS _DEFAULT_CIPHERS_WITH_SECLEVEL_0_DEFAULT_CIPHERS)r   s    c/home/ubuntu/.cache/pipx/cdb5059130eadca/lib/python3.12/site-packages/mitmproxy/addons/tlsconfig.py_default_ciphersr   B   s     ';;;//    #X509_CHECK_FLAG_NEVER_CHECK_SUBJECTc                   8    e Zd ZU edz  ed<   edz  ed<   eed<   y)AppDataNclient_alpnserver_alpnhttp2)__name__
__module____qualname__bytes__annotations__bool r   r   r"   r"   V   s    Kr   r"   connoptionsc                 ,   | j                         }|d   }|d   }|d   }|||v r|S t        j                  S |r||v r|S |dk(  rt        j                  S |rt        j                  nt        j
                  }|D ]
  }||v s|c S  t        j                  S )Nr#   r$   r%   r   )get_app_datar
   NO_OVERLAPPING_PROTOCOLS	proxy_tls
HTTP_ALPNSHTTP1_ALPNS)r-   r.   app_datar#   r$   r%   
http_alpnsalpns           r   alpn_select_callbackr8   \   s    ))+H=)K=)KWE'!///{g-c +++).%%I4I4IJ ,:K, +++r   c                      e Zd ZU dZdZej                  ed<   d Zde	j                  fdZde	j                  ddfd	Zde	j                  ddfd
Zdej                   ddfdZdej                   ddfdZd Zd ZdedefdZded   ddfdZdefdZdej8                  dej:                  fdZdej@                  fdZ!y)	TlsConfigzj
    This addon supplies the proxy core with the desired OpenSSL connection objects to negotiate TLS.
    N	certstorec           	         dj                  d t        j                  d d D              dt        j                  d   j                   z   }|j	                  dt
        t        j                  j                  t        j                  D cg c]  }|j                   c}d| d       |j	                  d	t
        t        j                  j                  t        j                  D cg c]  }|j                   c}d
       |j	                  dt
        t        j                  j                  t        j                  D cg c]  }|j                   c}d| d       |j	                  dt
        t        j                  j                  t        j                  D cg c]  }|j                   c}d       |j	                  dt
        d z  d d       |j	                  dt
        d z  d d       |j	                  dt        dd       |j	                  dt
        d z  d d       |j	                  dt
        d z  d d       y c c}w c c}w c c}w c c}w )N, c              3   4   K   | ]  }|j                     y wNname.0xs     r   	<genexpr>z!TlsConfig.load.<locals>.<genexpr>   s     MaffM   z and tls_version_client_minz4Set the minimum TLS version for client connections. z are insecure.)rA   typespecdefaultchoiceshelptls_version_client_maxz3Set the maximum TLS version for client connections.tls_version_server_minz4Set the minimum TLS version for server connections. tls_version_server_maxz3Set the maximum TLS version for server connections.tls_ecdh_curve_clientzUse a specific elliptic curve for ECDHE key exchange on client connections. OpenSSL syntax, for example "prime256v1" (see `openssl ecparam -list_curves`).)rA   rI   rJ   rL   tls_ecdh_curve_serverzUse a specific elliptic curve for ECDHE key exchange on server connections. OpenSSL syntax, for example "prime256v1" (see `openssl ecparam -list_curves`).request_client_certFzRequests a client certificate (TLS message 'CertificateRequest') to establish a mutual TLS connection between client and mitmproxy (combined with 'client_certs' option for mitmproxy and upstream).ciphers_clientzPSet supported ciphers for client <-> mitmproxy connections using OpenSSL syntax.ciphers_serverzPSet supported ciphers for mitmproxy <-> server connections using OpenSSL syntax.)
joinr   r   rA   
add_optionstrDEFAULT_MIN_VERSIONVersionDEFAULT_MAX_VERSIONr+   )selfloaderinsecure_tls_min_versionsrD   s       r   loadzTlsConfig.load   s7   IIMg&G&G&LMMg77;@@ABC 	" 	)//44%,__5QVV5G()9 	 	
 	)//44%,__5QVV5F 	 	
 	)//44%,__5QVV5G()9 	 	
 	)//44%,__5QVV5F 	 	
 	(4Z]	 	 	
 	(4Z]	 	 	
 	& X	 	 	
 	$J^		
 	$J^		
i 6 6 6 6s   H;#I ;II
tls_clienthelloc                     |j                   }|j                  j                  xr t        j                  j
                  dk(  |_        y )Neager)r   serverr   r   r.   connection_strategyestablish_server_tls_first)r[   r_   conn_contexts      r   r_   zTlsConfig.tls_clienthello   s8    &..##R(G(G7(R 	2r   	tls_startr   c                    |j                   yt        |j                  t        j                        sJ |j                  }|j
                  j                  }| j                  |j
                        }|j                  sHt        j                  j                  r.t        j                  j                  j                  d      |_        |j                  xs4 t        t        j                  t        j                  j                            }t        j                  j"                  r|j$                  }ng }t        j&                  |j(                  rt        j*                  j,                  nt        j*                  j.                  t        j                  t        j                  j                      t        j                  t        j                  j0                     t3        |      t        j4                  t        j                  j6                        |j8                  t        j                  j:                  t<        t3        |      | j>                  j@                  
      }tC        jD                  |      |_         |j                   jG                  |jH                  jK                                |j                   jM                  |jN                         tQ        |j
                  jR                        dk(  r4t        |j
                  jR                  d   tT        jV                        rd}n|jX                  }|j                   j[                  t]        ||jX                  t        j                  j^                               |j                   ja                          y)z/Establish TLS or DTLS between client and proxy.N:)
methodmin_versionmax_versioncipher_list
ecdh_curve
chain_filerR   r8   extra_chain_certsdhparams   r   s   http/1.1)r#   r$   r%   )1ssl_conn
isinstancer-   r   Clientr   rb   get_certrl   r   r.   rS   splitr   r   rY   rH   "add_upstream_certs_to_client_chaincertificate_listcreate_client_proxy_contextis_dtlsMethodDTLS_SERVER_METHODTLS_SERVER_METHODrM   tuple	get_curverP   rn   rR   r8   r;   rp   r
   
Connectionuse_certificatecertto_cryptographyuse_privatekey
privatekeylenlayersr   	HttpProxyr7   set_app_datar"   r%   set_accept_state)	r[   rf   clientrb   entryrl   ro   ssl_ctxr#   s	            r   tls_start_clientzTlsConfig.tls_start_client   sk   ))..**;*;<<<$-NN$-$5$5$<$<i//0!!ckk&@&@!$!;!;!A!A#!FF(( 
,<OOCKK>>?-
 ;;99 & 7 7 "55   >>4411(J(JK(J(JKk*(()J)JK'' # ? ?!5#$56^^,,
 !^^G4	**5::+E+E+GH))%*:*:;
 y  ''(A-*$$Q'3
 )4K ++K'''"KKkk''	
 	++-r   c                    |j                   yt        |j                  t        j                        sJ |j
                  j                  }|j                  }|j                  sJ t        j                  j                  rt        j                  j                  }nt        j                  j                  }|j                  "|j                  xs |j                  d   |_        |j                   sj|j                   rWt        j                  j"                  rt%        |j                         |_        n)t%        d |j                   D              |_        ng |_        |j&                  sHt        j                  j(                  r.t        j                  j(                  j+                  d      |_        |j&                  xs4 t-        t        j.                  t        j                  j0                           }d}t        j                  j2                  rt4        j6                  j9                  t        j                  j2                        }t4        j6                  j;                  |      r|}na|j                  xs |j                  d   }t4        j6                  j=                  || d      }	t4        j6                  j;                  |	      r|	}t        j>                  |j@                  rt        jB                  jD                  nt        jB                  jF                  t        j.                  t        j                  j0                     t        j.                  t        j                  jH                     t%        |      t        jJ                  t        j                  jL                        |t        j                  jN                  t        j                  jP                  |t        j                  j                  
      }
tS        jT                  |
      |_         |j                  rt        |j                  tV              sJ tR        jX                  j[                  |j                   j\                        }tR        jX                  j_                  |t`               	 tc        jd                  |j                        jf                  }tR        jX                  ji                  ||tk        |            }tS        jl                  |dk(         n'|t        j                  j                  urto        d	      |j                   r.|j                   jw                  ty        |j                                |j                   j{                          y# tn        $ r{ |j                  jq                  d      }|j                   js                  |       tR        jX                  ju                  ||tk        |            }tS        jl                  |dk(         Y w xY w)
z/Establish TLS or DTLS between proxy and server.Nr   c              3   ,   K   | ]  }|d k7  s	|  yw)s   h2Nr,   rB   s     r   rE   z-TlsConfig.tls_start_server.<locals>.<genexpr>-  s      /e/s   
rh   z.pem)
ri   rj   rk   rl   rm   verifyca_path
ca_pemfileclient_certlegacy_server_connect   idnaz0Cannot validate certificate hostname without SNI)>rr   rs   r-   r   Serverr   r   addressr   r.   ssl_insecurer   VerifyVERIFY_NONEVERIFY_PEERsnialpn_offersr%   r~   rl   rT   rv   r   rY   rN   client_certsospath
expanduserisfilerU   create_proxy_server_contextrz   r{   DTLS_CLIENT_METHODTLS_CLIENT_METHODrO   r   rQ   #ssl_verify_upstream_trusted_confdirssl_verify_upstream_trusted_car
   r   rW   _libSSL_get0_param_sslX509_VERIFY_PARAM_set_hostflagsDEFAULT_HOSTFLAGS	ipaddress
ip_addresspackedX509_VERIFY_PARAM_set1_ipr   _openssl_assert
ValueErrorencodeset_tlsext_host_nameX509_VERIFY_PARAM_set1_hostset_alpn_protoslistset_connect_state)r[   rf   r   rb   r   rl   r   r   server_namepr   paramipok	host_names                  r   tls_start_serverzTlsConfig.tls_start_server  s   ))..**;*;<<<$-$5$5$<$<$-NN~~~;;##^^//F^^//F::8v~~a'8FJ!!!!;;$$ */v/A/A)BF&). /#)#5#5/ *F& &("!!ckk&@&@!$!;!;!A!A#!FF(( 
,<OOCKK>>?-
 #';;##77--ckk.F.FGLww~~l+*#)::#B1BGGLL+d/CD77>>!$"#K55   >>4411(J(JK(J(JKk*(()J)JKKKCC{{AA#"%++":":
 !^^G4	::fjj#... HH++I,>,>,C,CDE HH44U<MN-%00<CC XX77r3r7K##B!G,7>>555OPP..tF4F4F/GH,,.%  -"JJ--f5	""77	BXX999c)n ##B!G,-s   )U0 0BW43W4c                 f   |j                   yt        j                         |_         t        |j                  t
        j                        sJ |j                  }|j                  j                  }| j                  |j                        }|j                  sHt        j                  j                  r.t        j                  j                  j                  d      |_
        t        j                  j                  r|j                   }ng }|j                  r0|j                  D cg c]  }t"        |    c}|j                   _        |j&                  |j&                  fD cg c]  }|s|	 c}xs |j(                  D cg c]  }|j+                  d       c}|j                   _        |j.                  j0                  |j                   _        |j4                  |j                   _        g |j8                  |D cg c]  }|j0                   c}|j                   _        yc c}w c c}w c c}w c c}w )z(Establish QUIC between client and proxy.Nrh   ascii)settingsr   QuicTlsSettingsrs   r-   r   rt   r   rb   ru   rl   r   r.   rS   rv   rw   rx   r   cipher_suitesr7   r   decodealpn_protocolsr   _certcertificater   certificate_private_keychain_certscertificate_chain)	r[   rf   r   rb   r   ro   cipherr7   r   s	            r   quic_start_clientzTlsConfig.quic_start_client{  s   )!113	 )..**;*;<<<$-NN$-$5$5$<$<i//0!!ckk&@&@!$!;!;!A!A#!FF;;99 & 7 7 " 282D2D0(.F#0I, ,2;;*DM$M "!!-
 KK -
	) */)9)9	&5:5E5E	2#KU%6%6#K9J#K0
DJJ0
	,0 N-
0
s   !HH$%H$<H)9H.c                    |j                   yt        j                         |_         t        |j                  t
        j                        sJ |j                  j                  }|j                  }|j                  sJ t        j                  j                  r t        j                  |j                   _        nt        j                   |j                   _        |j"                  "|j"                  xs |j                  d   |_        |j$                  sB|j$                  rt'        |j$                        |_        nt'        d t(        D              |_        |j*                  sHt        j                  j,                  r.t        j                  j,                  j/                  d      |_        |j*                  r0|j*                  D cg c]  }t0        |    c}|j                   _        |j$                  r8|j$                  D cg c]  }|j5                  d       c}|j                   _        t        j                  j8                  |j                   _        t        j                  j<                  |j                   _        yc c}w c c}w )z(Establish QUIC between proxy and server.Nr   c              3   >   K   | ]  }|j                  d         yw)r   N)r   )rC   r7   s     r   rE   z.TlsConfig.quic_start_server.<locals>.<genexpr>  s     *TD4;;w+?*Ts   rh   r   ) r   r   r   rs   r-   r   r   r   r   r   r   r.   r   ssl	CERT_NONEverify_modeCERT_REQUIREDr   r   r~   r   rl   rT   rv   r   r   r   r   r   r   r   ca_file)r[   rf   r   rb   r   r7   s         r   quic_start_serverzTlsConfig.quic_start_server  s   )!113	 )..**;*;<<<$-$5$5$<$<$-NN~~~;;##-0]]I*-0->->I*::8v~~a'8FJ!!!!%*6+=+=%>" &+*TG*T%T"!!ckk&@&@!$!;!;!A!A#!FF 282D2D0(.F#0I, 171C1C1)-G$1I- &)[[%T%T	"%([[%O%O	"01s    I9<I>c                 &    | j                  d       y )Nconfdir)	configurer[   s    r   runningzTlsConfig.running  s     	y!r   c           	      ~   d|v sd|v s	d|v sd|v rt         j                  j                  t        j                  j
                        }t        j                  j                  |t        t        j                  j                  t        j                  j                  r)t        j                  j                  j                  d      nd       | _        | j                  j                  j                         rt         j#                  d       t        j                  j                  D ]  }|j%                  dd	      }t'        |      d	k(  rd
|d   g}t)        |d	         j                         }|j+                         st-        j.                  d|       	 | j                  j1                  |d   |t        j                  j                  r)t        j                  j                  j                  d      nd         d|v sd|v rt        j                  j4                  t        j                  j6                  fD ]O  }||t8        j:                  vst-        j.                  d|ddj=                  t8        j:                                d|v r| j?                  dd       d|v r| j?                  dd       d|v r| j?                  dd       d|v r| j?                  dd       d|v sd|v r| jA                  d       d|v sd|v r| jA                  d       y y # t2        $ r!}t-        j.                  d| d|       |d }~ww xY w)Nr   r   key_sizecert_passphraseutf8)r   basenamer   
passphrasea  The mitmproxy certificate authority has expired!
Please delete all CA-related files in your ~/.mitmproxy folder.
The CA will be regenerated automatically after restarting mitmproxy.
See https://docs.mitmproxy.org/stable/concepts-certificates/ for additional help.=r   *r   z!Certificate file does not exist: )r   zInvalid certificate format for z: rP   rQ   zInvalid ECDH curve: z. Valid curves are: r=   rH   TrM   FrN   rO   rS   r   rT   rb   )!r   r   r   r   r.   r   r   	CertStore
from_storer   r   r   r   r;   
default_cahas_expiredloggerwarningrv   r   r   existsr   OptionsErroradd_cert_filer   rP   rQ   r   	EC_CURVESrU   _warn_unsupported_version_warn_seclevel_missing)r[   updatedcertstore_pathcertspecpartsr   erm   s           r   r   zTlsConfig.configure  s   wG#W$ G+WW//0C0CDN"__77#&--;;.. ;;66==fE 8 DN ~~((446h  KK--  sA.u:? %(OEE!H~002{{}$11;D6B NN00a;;66 $';;#>#>#E#Ef#M! 1 . #g-1HG1S1111 
 )j@Q@Q.Q$11.zn<PQUQZQZ[b[l[lQmPno  $w.**+CTJ#w.**+CUK#w.**+CTJ#w.**+CUK#w.2Bg2M''1#w.2Bg2M''1 3N3 " $119$r!Es   A$L	L<L77L<	attributewarn_unboundc                    t         j                  t        t        j                  |         }t         j                  D cg c]  }t        j
                  |      s| }}dj                  d |D              }|t         j                  j                  u r+|r(t        j                  | d|j                   d|        y y ||vr(t        j                  | d|j                   d|        y y c c}w )Nr=   c              3   4   K   | ]  }|j                     y wr?   r@   )rC   vs     r   rE   z6TlsConfig._warn_unsupported_version.<locals>.<genexpr>"  s     *Na166*NrF   z has been set to zI. Note that your OpenSSL build only supports the following TLS versions: zo, which is not supported by the current OpenSSL build. The current build only supports the following versions: )r   rY   getattrr   r.   is_supported_versionrU   	UNBOUNDEDr   inforA   r   )r[   r   r   valr   supported_versionssupported_versions_strs          r   r   z#TlsConfig._warn_unsupported_version  s    oogckk9=>
'*F*Fq*IA
 
 "&*N;M*N!N'//+++ k!2388* =OOeNfh 
 **NN+.sxxj 9KKaJbd +
s   C+C+side)r   rb   c           	      v   |dk(  r5t         j                  j                  }t         j                  j                  }n4t         j                  j                  }t         j                  j
                  }|rIt        j                  |   t        j                  v r%d|vr t        j                  d| d| d| d       yyyy)z
        OpenSSL cipher spec need to specify @SECLEVEL for old TLS versions to work,
        see https://github.com/pyca/cryptography/issues/9523.
        r   r   zWith tls_version_z_min set to z
, ciphers_z> must include "@SECLEVEL=0" for insecure TLS versions to work.N)r   r.   rS   rH   rT   rN   r   rY   r   r   r   )r[   r  custom_ciphersr   s       r   r   z TlsConfig._warn_seclevel_missing0  s    
 8 [[77N!kk@@O [[77N!kk@@O 0G4U4UU^3NN#D6o5FjQUPV W5 6 4 V r   c                 J    d| j                   j                  j                   dS )Nz/mitmproxy-z.crl)r;   r   serialr   s    r   crl_pathzTlsConfig.crl_pathF  s"    T^^66==>dCCr   re   c                    g }d}d}t         j                  j                  r|j                  j                  r|j                  j                  d   }|j
                  r$|j                  t        |j
                               |j                  |j                         |j                  r|j                  }|j                  x}rX	 t        j                  j                  |d         ^}}}	t        j                  j                  ||| j!                         ddf      }|j(                  j*                  r/|j                  t        |j(                  j*                               n1|j                  t        |j(                  j,                  d                |j                  j.                  r1|j                  t        |j                  j.                  d                t1        t2        j5                  |            }t7        d |D        d      }
| j8                  j;                  |
|||      S # t"        $ r t$        j'                  d|d          Y 3w xY w)z
        This function determines the Common Name (CN), Subject Alternative Names (SANs) and Organization Name
        our certificate should have and then fetches a matching cert from the certstore.
        Nr   zFailed to parse CRL URL: c              3   F   K   | ]  }t        |j                          y wr?   )rW   valuerB   s     r   rE   z%TlsConfig.get_cert.<locals>.<genexpr>v  s     2A3qww<2s   !)r   r.   upstream_certrb   rx   cnappend_ip_or_dns_nameextendaltnamesorganizationcrl_distribution_pointsurllibparseurlsplit
urlunsplitr  r   r   r   r   r   socknamer   r   dictfromkeysnextr;   ru   )r[   re   r  r  crl_distribution_pointr  crlsschemenetloc_r  s              r   ru   zTlsConfig.get_certI  s   
 ,.#'-1 ;;$$)<)<)M)M(4(;(;(L(LQ(OM0@0@ ABOOM223)),99 %<<<t<)/)>)>tAw)G&FFQ
 .4\\-D-D$E.*
 ""OOOL,?,?,C,CDEOOOL,?,?,H,H,KLM &&OOOL,?,?,G,G,JKL h/0 22D9~~&&,(>
 	
1 " IKK";DG; GHIs   %H% %$IIflowc                 .   |j                   r|j                  s|j                  ry |j                  j                  j                  | j                               r=t        j                  j                  d| j                  j                  ddi      |_        y y )N   zContent-Typezapplication/pkix-crl)liveerrorresponserequestr   endswithr  r   Responsemaker;   default_crl)r[   r   s     r   r&  zTlsConfig.request{  sj    yyDJJ$--<<%%dmmo6 MM..**!78DM 7r   )"r&   r'   r(   __doc__r;   r   r   r*   r^   r   ClientHelloDatar_   TlsDatar   r   r   QuicTlsDatar   r   r   r   rW   r+   r   r   r   r  r   ContextCertStoreEntryru   r   HTTPFlowr&  r,   r   r   r:   r:   u   s    "&Iu%B
H
s/B/B 
=.#++ =.$ =.~h/#++ h/$ h/T'
4+;+; '
 '
R,P4+;+; ,P ,P\"
D2L3 d &73E+F 4 ,D# D0
W__ 0
9M9M 0
d	DMM 	r   r:   r   c                     	 t        j                  |       }t        j                  |      S # t        $ r5 t        j
                  | j                  d      j                               cY S w xY w)zFConvert a string into either an x509.IPAddress or x509.DNSName object.r   )r   r   r	   	IPAddressr   DNSNamer   r   )r   r   s     r   r  r    sZ    "!!#& ~~b!!  9||CJJv.557889s   , ;A*)A*):r   loggingr   r   urllib.parser  pathlibr   typingr   r   r   aioquic.h3.connectionr   aioquic.tlsr   cryptographyr	   OpenSSLr
   	mitmproxyr   r   r   r   r   r   mitmproxy.netr   mitmproxy.optionsr   mitmproxy.proxyr   mitmproxy.proxy.layersr   r   r2   	getLoggerr&   r   r   r   rY   r~   rW   r   r   $X509_CHECK_FLAG_NO_PARTIAL_WILDCARDSr   r   r"   r   r   r)   r8   r:   GeneralNamer  r,   r   r   <module>rE     s     	 
      ) #           ( + # ( ' 3			8	$
 : %2#E4D#E  
 __
 
38_
  HH11chh=qAB i ,s~~ ,U , ,2O Od" "!1!1 "r   