search

hmgle / graftcp

A flexible tool for redirecting a given program's TCP traffic to SOCKS5 or HTTP proxy.
GNU General Public License v3.0
2.1k stars 173 forks source link

socks5_proxy still used while explicitly set 'select_proxy_mode' to 'only_http_proxy' #15

Closed jlxawk closed 5 years ago

jlxawk commented 5 years ago

Describe the bug option select_proxy_mode doesn't work as described with value only_http_proxy.

To Reproduce

  1. My graftcp-local configuration:

    $ grep -hv '^#' /etc/graftcp-local.conf | sed '/^$/d'
listen = :32233
loglevel = 1
socks5 = 127.0.0.1:9050
http_proxy = 127.0.0.1:18118
select_proxy_mode = only_http_proxy
use_syslog = true

  2. proxy on my machine:

    $ sudo ss -ltunp | egrep '9050|18118'
tcp     LISTEN   0        10             127.0.0.1:18118          0.0.0.0:*      users:(("VirtualBoxVM",pid=4059,fd=43))

  3. curl GET output througth VirtualBox proxy without graftcp (ensure that the VirtualBox http proxy actually works):

    $ curl --verbose --proxy http://127.0.0.1:18118 https://google.com
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 18118 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to google.com:443
> CONNECT google.com:443 HTTP/1.1
> Host: google.com:443
> User-Agent: curl/7.64.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.0 200 OK
<
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CONNECT phase completed!
* CONNECT phase completed!
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-CHACHA20-POLY1305
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=Mountain View; O=Google LLC; CN=*.google.com
*  start date: Mar  1 09:43:57 2019 GMT
*  expire date: May 24 09:25:00 2019 GMT
*  subjectAltName: host "google.com" matched cert's "google.com"
*  issuer: C=US; O=Google Trust Services; CN=Google Internet Authority G3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x556dcd136f20)
> GET / HTTP/2
> Host: google.com
> User-Agent: curl/7.64.0
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 301
< location: https://www.google.com/
< content-type: text/html; charset=UTF-8
< date: Fri, 08 Mar 2019 06:37:02 GMT
< expires: Sun, 07 Apr 2019 06:37:02 GMT
< cache-control: public, max-age=2592000
< server: gws
< content-length: 220
< x-xss-protection: 1; mode=block
< x-frame-options: SAMEORIGIN
< alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
<
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML>
* Connection #0 to host 127.0.0.1 left intact

  4. curl GET output with graftcp:

    graftcp -p 32233 curl --verbose https://google.com
*   Trying 216.58.220.206...
* TCP_NODELAY set
* Connected to google.com (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to google.com:443
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to google.com:443

  5. graftcp-local output (socks5 proxy still used here while I don't have a running socks5 proxy in my Linux box atm, as a result the connection failed):

    $ graftcp-local -config /etc/graftcp-local.conf
[2019-03-08 14:36:29] [NOTICE] graftcp-local start
[2019-03-08 14:36:29] [INFO] graft-local start listening :32233...
[2019-03-08 14:46:31] [INFO] Request PID: 24102, Source Addr: 127.0.0.1:57148, Dest Addr: 216.58.220.206:443
[2019-03-08 14:46:31] [ERROR] dialer.Dial(216.58.220.206:443) err: dial tcp 127.0.0.1:9050: connect: connection refused

Expected behavior curl should be able to connect to https://google.com via graftcp using the specified http_proxy (127.0.0.1:18118) as in configuration file.

Desktop:

hmgle commented 5 years ago

@jlxawk Thank you for your feedback. This bug seems to have been fixed just now. If it doesn't work, please reopen it :smile: