monkeyWie / proxyee

HTTP proxy server,support HTTPS&websocket.MITM impl,intercept and tamper HTTPS traffic.
MIT License
1.52k stars 572 forks source link

https POST请求卡死 #244

Closed lengong closed 1 year ago

lengong commented 1 year ago
  1. proxyee不设置HttpProxyInterceptInitializer
  2. HttpProxyInterceptInitializer match方法直接返回false 以上两种情况下 https POST第一次请求正常,第二次卡死 http POST正常

定位发现问题出现在类com.github.monkeywie.proxyee.handler.HttpProxyServerHandler的如下代码

if (getIsConnect()) {
    getChannelFuture().channel().writeAndFlush(msg);
} else {
    getRequestList().add(msg);
}

第二次请求走进if分支,如果屏蔽if分支,则能正常收到响应

monkeyWie commented 1 year ago

我测试了下,没能复现,代码:

new HttpProxyServer().start(9999);

测试请求:

curl -k -x 127.0.0.1:9999 \
      -X POST \
      http://www.baidu.com \
      -H 'Content-Type: application/json' \
      -d '{"test":"123456"}'

连续多次没出现卡死

lengong commented 1 year ago

一方面是要https,另一方面是要复用连接 你用curl 每次都是重新创建连接,就不回出现这个问题

你用下面的代码就可以复现

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import javax.net.ssl.HostnameVerifier; import javax.net.ssl.SSLContext;

import org.apache.http.HttpEntity; import org.apache.http.HttpHost; import org.apache.http.HttpResponse; import org.apache.http.client.config.RequestConfig; import org.apache.http.client.methods.HttpPost; import org.apache.http.conn.ssl.NoopHostnameVerifier; import org.apache.http.conn.ssl.SSLConnectionSocketFactory; import org.apache.http.entity.StringEntity; import org.apache.http.impl.client.CloseableHttpClient; import org.apache.http.impl.client.HttpClients; import org.apache.http.ssl.SSLContextBuilder; import org.apache.http.ssl.TrustStrategy; import org.apache.http.util.EntityUtils;

public class TTT { public static String post(String url,String data,CloseableHttpClient httpClient) { HttpPost httpPost = new HttpPost(url); httpPost.setHeader("Content-Type", "application/json"); try {// httpPost.setEntity(new StringEntity(data)); HttpResponse response = httpClient.execute(httpPost); HttpEntity entity = response.getEntity(); String content = EntityUtils.toString(entity); return content; } catch (Exception e) { // TODO Auto-generated catch block e.printStackTrace(); } return null; }

public static void main(String[] arge) {
    try {
        SSLContext sslContext = new SSLContextBuilder().loadTrustMaterial(null, new TrustStrategy() {
            // 信任所有
            public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException {
                return true;
            }
        }).build();

        HostnameVerifier hostnameVerifier = NoopHostnameVerifier.INSTANCE;
        SSLConnectionSocketFactory sslcsf = new SSLConnectionSocketFactory(sslContext, hostnameVerifier);
        org.apache.http.client.config.RequestConfig.Builder builder = RequestConfig.custom();

        builder.setProxy(new HttpHost("127.0.0.1", 9999, "http"));
        org.apache.http.impl.client.HttpClientBuilder httpBuilder =  HttpClients.custom();
        httpBuilder.setSSLSocketFactory(sslcsf);
        httpBuilder.setDefaultRequestConfig(builder.build()).build();
        CloseableHttpClient httpClient = httpBuilder.build();
        String json = post("https://www.baidu.com","{\"test\":\"123456\"}",httpClient);
        System.out.println(json);
        json = post("https://www.baidu.com","{\"test\":\"123456\"}",httpClient);
        System.out.println(json);

    } catch (Exception e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
}

}

monkeyWie commented 1 year ago

我用你的代码还是复现不了会报错,而且你这代码我测试了下好像没有复用tcp连接,curl 是支持复用的,用这个命令测试的没问题:

curl -v -k -x 127.0.0.1:9999 \
      -X POST \
      https://www.baidu.com \
      -H 'Content-Type: application/json' \
      -d '{"test":"123456"}' \
      -X POST \
      https://www.baidu.com \
      -H 'Content-Type: application/json' \
      -d '{"test":"123456"}'
lengong commented 1 year ago

你开启https拦截了吗,程序默认是不拦截https的,我用你 curl 是支持复用的的命令是能复现的

monkeyWie commented 1 year ago

。。你没描述清楚啊,开了https拦截之后确实复现了

monkeyWie commented 1 year ago

已修复:https://github.com/monkeyWie/proxyee/pull/246