[tor-commits] [meek/master] https proxy support for uTLS.

9 May 2019

commit 4290a67a65a98303b2feb34a230ab23daabb9895
Author: David Fifield david@bamsoftware.com
Date:   Fri Feb 1 01:46:07 2019 -0700
https proxy support for uTLS.
Tor doesn't support this kind of proxy (https://bugs.torproject.org/26306),
    but I want to support the same kinds of proxies with uTLS as are
    supported using the native Go net/http, for ease of explaining the proxy
    restrictions in the man page.
We use the same uTLS ClientHelloID for the TLS connection to the HTTPS
    proxy, as we use for the TLS connection through the tunnel.
---
 meek-client/proxy_http.go | 27 +++++++++++++
 meek-client/proxy_test.go | 96 ++++++++++++++++++++++++++++++++++++++++++-----
 meek-client/utls.go       | 14 ++++++-
 meek-client/utls_test.go  |  1 +
 4 files changed, 127 insertions(+), 11 deletions(-)

diff --git a/meek-client/proxy_http.go b/meek-client/proxy_http.go
index 1136eb2..f9aeb71 100644
--- a/meek-client/proxy_http.go
+++ b/meek-client/proxy_http.go
@@ -8,6 +8,7 @@ import (
    "net/http"
    "net/url"
+	utls "github.com/refraction-networking/utls"
    "golang.org/x/net/proxy"
 )
@@ -74,3 +75,29 @@ func ProxyHTTP(network, addr string, auth *proxy.Auth, forward proxy.Dialer) (*h
    	forward: forward,
    }, nil
 }
+
+type UTLSDialer struct {
+	config        *utls.Config
+	clientHelloID *utls.ClientHelloID
+	forward       proxy.Dialer
+}
+
+func (dialer *UTLSDialer) Dial(network, addr string) (net.Conn, error) {
+	return dialUTLS(network, addr, dialer.config, dialer.clientHelloID, dialer.forward)
+}
+
+func ProxyHTTPS(network, addr string, auth *proxy.Auth, forward proxy.Dialer, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (*httpProxy, error) {
+	return &httpProxy{
+		network: network,
+		addr:    addr,
+		auth:    auth,
+		forward: &UTLSDialer{
+			config: cfg,
+			// We use the same uTLS ClientHelloID for the TLS
+			// connection to the HTTPS proxy, as we use for the TLS
+			// connection through the tunnel.
+			clientHelloID: clientHelloID,
+			forward:       forward,
+		},
+	}, nil
+}
diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go
index c13cf12..b44c9a2 100644
--- a/meek-client/proxy_test.go
+++ b/meek-client/proxy_test.go
@@ -2,12 +2,21 @@ package main
import (
    "bufio"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
    "io"
+	"math/big"
    "net"
    "net/http"
    "net/url"
    "testing"
+	"time"
+	utls "github.com/refraction-networking/utls"
    "golang.org/x/net/proxy"
 )
@@ -67,15 +76,9 @@ func TestAddrForDial(t *testing.T) {
// Dial the given address with the given proxy, and return the http.Request that
 // the proxy server would have received.
-func requestResultingFromDial(t *testing.T, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) {
+func requestResultingFromDial(t *testing.T, ln net.Listener, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) {
    ch := make(chan *http.Request, 1)
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		return nil, err
-	}
-	defer ln.Close()
-
    go func() {
    	defer func() {
    		close(ch)
@@ -109,9 +112,18 @@ func requestResultingFromDial(t *testing.T, makeProxy func(addr net.Addr) (*http
    return <-ch, nil
 }
+func requestResultingFromDialHTTP(t *testing.T, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, err
+	}
+	defer ln.Close()
+	return requestResultingFromDial(t, ln, makeProxy, network, addr)
+}
+
 // Test that the HTTP proxy client sends a correct request.
 func TestProxyHTTPCONNECT(t *testing.T) {
-	req, err := requestResultingFromDial(t, func(addr net.Addr) (*httpProxy, error) {
+	req, err := requestResultingFromDialHTTP(t, func(addr net.Addr) (*httpProxy, error) {
    	return ProxyHTTP("tcp", addr.String(), nil, proxy.Direct)
    }, "tcp", testAddr)
    if err != nil {
@@ -134,7 +146,7 @@ func TestProxyHTTPProxyAuthorization(t *testing.T) {
    	User:     testUsername,
    	Password: testPassword,
    }
-	req, err := requestResultingFromDial(t, func(addr net.Addr) (*httpProxy, error) {
+	req, err := requestResultingFromDialHTTP(t, func(addr net.Addr) (*httpProxy, error) {
    	return ProxyHTTP("tcp", addr.String(), auth, proxy.Direct)
    }, "tcp", testAddr)
    if err != nil {
@@ -163,3 +175,69 @@ func TestProxyHTTPProxyAuthorization(t *testing.T) {
    	t.Errorf("expected password %q, got %q", testPassword, password)
    }
 }
+
+// Create a TLS listener using a temporary self-signed certificate.
+// https://golang.org/src/crypto/tls/generate_cert.go
+func selfSignedTLSListen(network, addr string) (net.Listener, error) {
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+
+	notBefore := time.Now()
+	notAfter := notBefore.Add(100 * time.Second)
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(123),
+		Subject: pkix.Name{
+			Organization: []string{"Test"},
+		},
+		NotBefore:             notBefore,
+		NotAfter:              notAfter,
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		IsCA:                  true,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+	}
+
+	cert, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
+	if err != nil {
+		return nil, err
+	}
+	config := tls.Config{
+		Certificates: []tls.Certificate{
+			tls.Certificate{
+				Certificate: [][]byte{cert},
+				PrivateKey:  priv,
+			},
+		},
+	}
+
+	return tls.Listen(network, addr, &config)
+}
+
+func requestResultingFromDialHTTPS(t *testing.T, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) {
+	ln, err := selfSignedTLSListen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, err
+	}
+	defer ln.Close()
+	return requestResultingFromDial(t, ln, makeProxy, network, addr)
+}
+
+func TestProxyHTTPSCONNECT(t *testing.T) {
+	req, err := requestResultingFromDialHTTPS(t, func(addr net.Addr) (*httpProxy, error) {
+		return ProxyHTTPS("tcp", addr.String(), nil, proxy.Direct, &utls.Config{InsecureSkipVerify: true}, &utls.HelloFirefox_Auto)
+	}, "tcp", testAddr)
+	if err != nil {
+		panic(err)
+	}
+	if req.Method != "CONNECT" {
+		t.Errorf("expected method %q, got %q", "CONNECT", req.Method)
+	}
+	if req.URL.Hostname() != testHost || req.URL.Port() != testPort {
+		t.Errorf("expected URL %q, got %q", testAddr, req.URL.String())
+	}
+	if req.Host != testAddr {
+		t.Errorf("expected %q, got %q", "Host: "+req.Host, "Host: "+testAddr)
+	}
+}
diff --git a/meek-client/utls.go b/meek-client/utls.go
index 5c1e484..66b1a93 100644
--- a/meek-client/utls.go
+++ b/meek-client/utls.go
@@ -155,7 +155,7 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 // use by setting Proxy on an http.Transport), and unlike when using the browser
 // helper (the browser has its own proxy support), when using uTLS we have to
 // craft our own proxy connections.
-func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) {
+func makeProxyDialer(proxyURL *url.URL, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (proxy.Dialer, error) {
    var proxyDialer proxy.Dialer = proxy.Direct
    if proxyURL == nil {
    	return proxyDialer, nil
@@ -181,6 +181,16 @@ func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) {
    	proxyDialer, err = proxy.SOCKS5("tcp", proxyAddr, auth, proxyDialer)
    case "http":
    	proxyDialer, err = ProxyHTTP("tcp", proxyAddr, auth, proxyDialer)
+	case "https":
+		// We use the same uTLS Config for TLS to the HTTPS proxy, as we
+		// use for HTTPS connections through the tunnel. We make a clone
+		// of the Config to avoid concurrent modification as the two
+		// layers set the ServerName value.
+		var cfgClone *utls.Config
+		if cfg != nil {
+			cfgClone = cfg.Clone()
+		}
+		proxyDialer, err = ProxyHTTPS("tcp", proxyAddr, auth, proxyDialer, cfgClone, clientHelloID)
    default:
    	return nil, fmt.Errorf("cannot use proxy scheme %q with uTLS", proxyURL.Scheme)
    }
@@ -293,7 +303,7 @@ func NewUTLSRoundTripper(name string, cfg *utls.Config, proxyURL *url.URL) (http
    	return httpRoundTripper, nil
    }
-	proxyDialer, err := makeProxyDialer(proxyURL)
+	proxyDialer, err := makeProxyDialer(proxyURL, cfg, clientHelloID)
    if err != nil {
    	return nil, err
    }
diff --git a/meek-client/utls_test.go b/meek-client/utls_test.go
index fbdd969..eebb1db 100644
--- a/meek-client/utls_test.go
+++ b/meek-client/utls_test.go
@@ -264,6 +264,7 @@ func TestUTLSHTTPWithProxy(t *testing.T) {
    for _, proxyURL := range []url.URL{
    	url.URL{Scheme: "socks5", Host: proxyLn.Addr().String()},
    	url.URL{Scheme: "http", Host: proxyLn.Addr().String()},
+		url.URL{Scheme: "https", Host: proxyLn.Addr().String()},
    } {
    	rt, err := NewUTLSRoundTripper("HelloFirefox_63", &utls.Config{InsecureSkipVerify: true}, &proxyURL)
    	if err != nil {

    

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

[tor-commits] [meek/master] https proxy support for uTLS.