search

droe / sslsplit

Transparent SSL/TLS interception
https://www.roe.ch/SSLsplit
BSD 2-Clause "Simplified" License
1.75k stars 329 forks source link

Use client-requested cipher suites for server connection and support anonymous suites #133

Open droe opened 8 years ago

droe commented 8 years ago

The cipher suites requested by the client should be used in the connection towards the server, as long as they can be handled by sslsplit and the version of OpenSSL that is in use. This idea came up in #126. This is a bit complex because we need to manually parse the cipher suites from the Client Hello message before creating the source SSL bufferevent in order to correctly configure the destination SSL bufferevent.

Support for anonymous cipher suites is currently untested and may or may not work. This should be tested (both ssl and autossl proxyspecs) and necessary fixes implemented so that when a client requests anonymous cipher suites, they are actually used.

crazy-william commented 8 years ago

I research the API of openssl, do not find the appropriate function to set cipher list. Only get this: SSL_CTX_set_cipher_list SSL_set_cipher_list But they only set the whole cipher suites, not list.