feat: should copy information from server when proxy generate certificate for client

[xudejian]

we know that some app might verify the SNI or DNSName, and app might also delegate the webview's http connect, so we should copy the correct cert information from server, which would lower the possibility of fail when goproxy handshake with client.

following is my code in my practice.

var certs = make(map[string]*tls.Certificate)

func TLSConfigFromCA(ca *tls.Certificate) func(host string, ctx *goproxy.ProxyCtx) (*tls.Config, error) {
    return func(host string, ctx *goproxy.ProxyCtx) (*tls.Config, error) {
        ctx.Logf("signing for %s", host)

                // should add the certstore back
        cert, err := getCert(host, ca)
        if err != nil {
            ctx.Warnf("Cannot sign host certificate with provided CA: %s", err)
            return nil, err
        }

        config := &tls.Config{
            InsecureSkipVerify: true,
            Certificates:       []tls.Certificate{*cert},
        }
        return config, nil
    }
}

func getCert(hostport string, ca *tls.Certificate) (*tls.Certificate, error) {
    hostname, _, _ := net.SplitHostPort(hostport)
    if cert, ok := certs[hostname]; ok {
        return cert, nil
    }

    conn, err := tls.Dial("tcp", hostport, &tls.Config{InsecureSkipVerify: true})
    if err != nil {
        fmt.Println("failed to connect:", hostport, "Err:", err)
        return nil, err
    }
    defer conn.Close()

    err = conn.Handshake()
    if err != nil {
        return nil, err
    }
    state := conn.ConnectionState()
    cert, err := signHost(ca, state.PeerCertificates[0], []string{hostname})
    if err != nil {
        return nil, err
    }
    certs[hostname] = cert
    return cert, err
}

func signHost(ca *tls.Certificate, orig *x509.Certificate, hosts []string) (cert *tls.Certificate, err error) {
        //
    for _, h := range hosts {
        if ip := net.ParseIP(h); ip != nil {
            template.IPAddresses = append(template.IPAddresses, ip)
        } else {
            template.DNSNames = append(template.DNSNames, h)
            template.Subject.CommonName = h
        }
    }
        //... insert code here, copy information from server
        if orig != nil {
        template.Subject = orig.Subject
        template.DNSNames = orig.DNSNames
        template.EmailAddresses = orig.EmailAddresses
        template.IPAddresses = orig.IPAddresses
        template.URIs = orig.URIs

        template.NotBefore = orig.NotBefore
        template.NotAfter = orig.NotAfter
        template.KeyUsage = orig.KeyUsage
        template.ExtKeyUsage = orig.ExtKeyUsage
    }
        //...

}

[vbisbest]

Hello. I was looking at implementing this but the code does not match the current master. There is no "orig" in signHost for example. Do you have a fork where you implemented this?

[xudejian]

Hello. I was looking at implementing this but the code does not match the current master. There is no "orig" in signHost for example. Do you have a fork where you implemented this?

this code could work with the current master, according to the example: https://github.com/elazarl/goproxy/blob/master/examples/goproxy-customca/cert.go

we can use our own TLSConfigFromCA to DIY the signHost function.