quicklisp / quicklisp-client

Quicklisp client.
http://www.quicklisp.org/
MIT License
298 stars 75 forks source link

Issues when using proxy to map HTTP to HTTPS #214

Closed HiPhish closed 2 years ago

HiPhish commented 2 years ago

Hello,

I want to solved the security issue by performing an intentional MITM attack on myself and redirect all HTTP requests to HTTPS. I am using mitmproxy to intercept HTTP requests from Quicklisp and perform the corresponding HTTPS request, then forward the result back to Quicklisp. This should give me the security of TLS without having to modify Quicklisp itself. Here is how I started mitmproxy:

mitmproxy --listen-port 8090 --map-remote '/^http/https'

The proxy is running on port 8090 and the Python regular expression ^http will be replaced by https in every request. Afterwards I install Quicklisp by invoking sbcl --load quicklisp.lisp:

(quicklisp-quickstart:install :path "/home/hiphish/.local/share/common-lisp/quicklisp" :proxy "localhost:8090")

This works fine at first, four HTTPS requests are performed:

However, after the last request setup.lisp times out. Here is the complete output of SBCL:

$ sbcl --load quicklisp.lisp
This is SBCL 2.2.2.void.1, an implementation of ANSI Common Lisp.
More information about SBCL is available at <http://www.sbcl.org/>.

  ==== quicklisp quickstart 2015-01-28 loaded ====

    To continue with installation, evaluate: (quicklisp-quickstart:install)

    For installation options, evaluate: (quicklisp-quickstart:help)

Linedit version 0.17.6, smart mode, ESC-h for help.
CL-USER(1): (quicklisp-quickstart:install :path "/home/hiphish/.local/share/common-lisp/quicklisp" :proxy "localhost:WARNING: Making quicklisp part of the install pathname directory

; Fetching #<URL "http://beta.quicklisp.org/client/quicklisp.sexp">
; 0.82KB
==================================================
839 bytes in 0.00 seconds (0.00KB/sec)
; Fetching #<URL "http://beta.quicklisp.org/client/2021-02-13/quicklisp.tar">
; 260.00KB
==================================================
266,240 bytes in 0.00 seconds (0.00KB/sec)
; Fetching #<URL "http://beta.quicklisp.org/client/2021-02-11/setup.lisp">
; 4.94KB
==================================================
5,057 bytes in 0.00 seconds (0.00KB/sec)
; Fetching #<URL "http://beta.quicklisp.org/asdf/3.2.1/asdf.lisp">
; 628.18KB
==================================================
643,253 bytes in 0.00 seconds (0.00KB/sec)While evaluating the form starting at line 135, column 0
  of #P"/home/hiphish/.local/share/common-lisp/quicklisp/setup.lisp":

debugger invoked on a SB-BSD-SOCKETS:OPERATION-TIMEOUT-ERROR in thread
#<THREAD "main thread" RUNNING {1001528073}>:
  Socket error in "connect": ETIMEDOUT (Connection timed out)

Type HELP for debugger help, or (SB-EXT:EXIT) to exit from SBCL.

restarts (invokable by number or by possibly-abbreviated name):
  0: [RETRY   ] Retry EVAL of current toplevel form.
  1: [CONTINUE] Ignore error and continue loading file "/home/hiphish/.local/share/common-lisp/quicklisp/setup.lisp".
  2: [ABORT   ] Abort loading file "/home/hiphish/.local/share/common-lisp/quicklisp/setup.lisp".
  3:            Exit debugger, returning to top level.

(SB-BSD-SOCKETS:SOCKET-ERROR "connect" 110)
   error finding frame source: Bogus form-number: the source file has probably
                               changed too much to cope with.
   source: NIL
0]

Here is the backtrace:

Backtrace for: #<SB-THREAD:THREAD "main thread" RUNNING {1001528073}>
0: (SB-BSD-SOCKETS:SOCKET-ERROR "connect" 110)
1: (SB-BSD-SOCKETS::CALL-WITH-SOCKET-ADDR #<SB-BSD-SOCKETS:INET-SOCKET 0.0.0.0:56708, fd: 7 {10051830E3}> (#(0 0 31 154) 80) #<FUNCTION (FLET SB-BSD-SOCKETS::WITH-SOCKET-ADDR-THUNK :IN SB-BSD-SOCKETS:SOCKET-CONNECT) {7F3FC15EE89B}>)
2: ((:METHOD SB-BSD-SOCKETS:SOCKET-CONNECT (SB-BSD-SOCKETS:SOCKET)) #<SB-BSD-SOCKETS:INET-SOCKET 0.0.0.0:56708, fd: 7 {10051830E3}> #(0 0 31 154) 80) [fast-method]
3: ((:METHOD QL-NETWORK::%OPEN-CONNECTION (QL-IMPL:SBCL T T)) #<unused argument> "8090" 80) [fast-method]
4: ((:METHOD QL-NETWORK::%CALL-WITH-CONNECTION (T T T T)) #<unused argument> "8090" 80 #<FUNCTION (LAMBDA (QL-HTTP::CONNECTION) :IN QL-HTTP:HTTP-FETCH) {1005182A4B}>) [fast-method]
5: (QL-HTTP:HTTP-FETCH #<QL-HTTP:URL "http://beta.quicklisp.org/dist/quicklisp.txt"> #P"/home/hiphish/.local/share/common-lisp/quicklisp/tmp/install-dist-distinfo.txt" :FOLLOW-REDIRECTS T :QUIETLY NIL :IF-EXISTS :RENAME-AND-DELETE :MAXIMUM-REDIRECTS NIL)
6: (QL-DIST:INSTALL-DIST #<QL-HTTP:URL "http://beta.quicklisp.org/dist/quicklisp.txt"> :PROMPT NIL :REPLACE NIL)
7: (QUICKLISP-CLIENT:SETUP)
8: (SB-INT:SIMPLE-EVAL-IN-LEXENV (QUICKLISP-CLIENT:SETUP) #<NULL-LEXENV>)
9: (SB-EXT:EVAL-TLF (QUICKLISP-CLIENT:SETUP) 15 NIL)
10: ((LABELS SB-FASL::EVAL-FORM :IN SB-INT:LOAD-AS-SOURCE) (QUICKLISP-CLIENT:SETUP) 15)
11: ((LAMBDA (SB-KERNEL:FORM &KEY :CURRENT-INDEX &ALLOW-OTHER-KEYS) :IN SB-INT:LOAD-AS-SOURCE) (QUICKLISP-CLIENT:SETUP) :CURRENT-INDEX 15)
12: (SB-C::%DO-FORMS-FROM-INFO #<FUNCTION (LAMBDA (SB-KERNEL:FORM &KEY :CURRENT-INDEX &ALLOW-OTHER-KEYS) :IN SB-INT:LOAD-AS-SOURCE) {100398D7BB}> #<SB-C::SOURCE-INFO {100398D783}> SB-C::INPUT-ERROR-IN-LOAD)
13: (SB-INT:LOAD-AS-SOURCE #<SB-INT:FORM-TRACKING-STREAM for "file /home/hiphish/.local/share/common-lisp/quicklisp/setup.lisp" {100398BD83}> :VERBOSE NIL :PRINT NIL :CONTEXT "loading")
14: ((LABELS SB-FASL::LOAD-STREAM-1 :IN LOAD) #<SB-INT:FORM-TRACKING-STREAM for "file /home/hiphish/.local/share/common-lisp/quicklisp/setup.lisp" {100398BD83}> NIL)
15: (SB-FASL::CALL-WITH-LOAD-BINDINGS #<FUNCTION (LABELS SB-FASL::LOAD-STREAM-1 :IN LOAD) {7F3FC15EF4AB}> #<SB-INT:FORM-TRACKING-STREAM for "file /home/hiphish/.local/share/common-lisp/quicklisp/setup.lisp" {100398BD83}> NIL #<SB-INT:FORM-TRACKING-STREAM for "file /home/hiphish/.local/share/common-lisp/quicklisp/setup.lisp" {100398BD83}>)
16: (LOAD #P"/home/hiphish/.local/share/common-lisp/quicklisp/setup.lisp" :VERBOSE NIL :PRINT NIL :IF-DOES-NOT-EXIST T :EXTERNAL-FORMAT :DEFAULT)
17: (QUICKLISP-QUICKSTART::INITIAL-INSTALL :CLIENT-URL "http://beta.quicklisp.org/client/quicklisp.sexp" :DIST-URL NIL)
18: ((:METHOD QLQS-IMPL-UTIL::%CALL-WITH-QUIET-COMPILATION (T T)) #<QLQS-IMPL:SBCL {1004F64643}> #<FUNCTION (LAMBDA NIL :IN QUICKLISP-QUICKSTART:INSTALL) {10027ADEAB}>) [fast-method]
19: ((:METHOD QLQS-IMPL-UTIL::%CALL-WITH-QUIET-COMPILATION :AROUND (QLQS-IMPL:SBCL T)) #<QLQS-IMPL:SBCL {1004F64643}> #<FUNCTION (LAMBDA NIL :IN QUICKLISP-QUICKSTART:INSTALL) {10027ADEAB}>) [fast-method]
20: (QUICKLISP-QUICKSTART:INSTALL :PATH "/home/hiphish/.local/share/common-lisp/quicklisp" :PROXY "localhost:8090" :CLIENT-URL NIL :CLIENT-VERSION NIL :DIST-URL NIL :DIST-VERSION NIL)
21: (SB-INT:SIMPLE-EVAL-IN-LEXENV (QUICKLISP-QUICKSTART:INSTALL :PATH "/home/hiphish/.local/share/common-lisp/quicklisp" :PROXY "localhost:8090") #<NULL-LEXENV>)
22: (EVAL (QUICKLISP-QUICKSTART:INSTALL :PATH "/home/hiphish/.local/share/common-lisp/quicklisp" :PROXY "localhost:8090"))
23: (SB-EXT:INTERACTIVE-EVAL (QUICKLISP-QUICKSTART:INSTALL :PATH "/home/hiphish/.local/share/common-lisp/quicklisp" :PROXY "localhost:8090") :EVAL NIL)
24: (SB-ACLREPL::REP-ONE)
25: (SB-ACLREPL::REPL :BREAK-LEVEL 0 :NOPRINT NIL :INSPECT NIL :CONTINUABLE NIL)
26: ((LAMBDA (SB-ACLREPL::NOPRINT) :IN SB-ACLREPL:MAKE-REPL-FUN) NIL)
27: ((LAMBDA NIL :IN SB-IMPL::TOPLEVEL-REPL))
28: (SB-IMPL::%WITH-REBOUND-IO-SYNTAX #<FUNCTION (LAMBDA NIL :IN SB-IMPL::TOPLEVEL-REPL) {100243B09B}>)
29: (SB-IMPL::TOPLEVEL-REPL NIL)
30: (SB-IMPL::TOPLEVEL-INIT)
31: ((FLET SB-UNIX::BODY :IN SB-IMPL::START-LISP))
32: ((FLET "WITHOUT-INTERRUPTS-BODY-3" :IN SB-IMPL::START-LISP))
33: (SB-IMPL::START-LISP)

If I choose to CONTINUE I get the message that Quicklisp has been installed correctly, however Quicklisp does not work correctly. I tried the following in a new SBCL instance

CL-USER(3): (ql:quickload "vecto")

debugger invoked on a QUICKLISP-CLIENT:SYSTEM-NOT-FOUND in thread
#<THREAD "main thread" RUNNING {1004AB8073}>:
  System "vecto" not found

Type HELP for debugger help, or (SB-EXT:EXIT) to exit from SBCL.

restarts (invokable by number or by possibly-abbreviated name):
  0: [CONTINUE               ] Try again
  1: [ABORT                  ] Give up on "vecto"
  2: [REGISTER-LOCAL-PROJECTS] Register local projects and try again.
  3:                           Exit debugger, returning to top level.

((LABELS QUICKLISP-CLIENT::RECURSE :IN QUICKLISP-CLIENT::COMPUTE-LOAD-STRATEGY) "vecto")
   source: (CERROR "Try again" 'SYSTEM-NOT-FOUND :NAME NAME)
0] 1

CL-USER(4): (ql:update-dist "quicklisp")

debugger invoked on a SB-PCL::NO-APPLICABLE-METHOD-ERROR in thread
#<THREAD "main thread" RUNNING {1004AB8073}>:
  There is no applicable method for the generic function
    #<STANDARD-GENERIC-FUNCTION QL-DIST:AVAILABLE-UPDATE (1)>
  when called with arguments
    (NIL).
See also:
  The ANSI Standard, Section 7.6.6

Type HELP for debugger help, or (SB-EXT:EXIT) to exit from SBCL.

restarts (invokable by number or by possibly-abbreviated name):
  0: [RETRY] Retry calling the generic function.
  1: [ABORT] Exit debugger, returning to top level.

((:METHOD NO-APPLICABLE-METHOD (T)) #<STANDARD-GENERIC-FUNCTION QL-DIST:AVAILABLE-UPDATE (1)> NIL) [fast-method]
0]

Mitmproxy has not intercepted any new requests either since the original four, even though (ql:config-value "proxy-url") evaluates to "localhost:8090".

HiPhish commented 2 years ago

Forgot to mention: my system is Void Linux with glibc, software I am running:

HiPhish commented 2 years ago

I have solved it, my proxy specification was wrong. I should have installed Quicklisp as

(quicklisp-quickstart:install :path "/home/hiphish/.local/share/common-lisp/quicklisp" :proxy "http://localhost:8090/")

Now I can finally enjoy Quicklisp safely.