search

rust-lang / rustup

The Rust toolchain installer
https://rust-lang.github.io/rustup/
Apache License 2.0
6.18k stars 891 forks source link

Unable to download behind corporate (SSL MITM) proxy. #1542

Open kvakhil95 opened 6 years ago

kvakhil95 commented 6 years ago

I get the following error when I run the command rustup-init -y: could not download file from 'https://static.rust-lang.org/dist/channel-rust-stable.toml.sha256' to '/root/.rustup/tmp/7wzxxkvb0v94ftm8_file' info: caused by: error during download info: caused by: [35] SSL connect error

This is because I'm behind a corporate proxy. So I tried changing the file rustup-init.sh to add the -k flag to turn off curl's certificate verification. However, this doesn't seem to affect the file as it is throwing the above error.

The rustup-init file has the 20th line as: '#XXX: If you change anything here, please make the same changes in setup_mode.rs'

I find no such file in my system. Where do I get this file? Is there any other alternative to help me download without curl's certificate verification?

pffang commented 5 years ago

same problem

hai-ld commented 5 years ago

same here

anton-pt commented 5 years ago

I'm having the same problem on a Windows machine. Any known fix?

orthoxerox commented 5 years ago

Something like https://docs.rs/curl/0.4.19/curl/easy/struct.Easy.html#method.ssl_verify_host / https://docs.rs/reqwest/0.9.8/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs should be added to the curl/reqwest builder to allow rustup to work with mitm corporate proxies. It's an easy fix, except you need rust to build new rustup-init...

rohitjoshi commented 5 years ago

Any update on this?

kinnison commented 5 years ago

We continue to discuss this in #1624

GrumpyMetalGuy commented 5 years ago

Given that #1624 just got closed down, is this the right place to discuss?

I've been trying for a year now to get traction on Rust at work, and this stops it every single time. This is an active blocker that corporate security will not work around, so we need something if we want to get Rust used in larger multinationals. (that and Artifactory support, although that's another story/ticket)...

kinnison commented 5 years ago

Once I have a way to let rustup verify the GPG signatures on channels, it becomes more viable to allow it to ignore certificate issues. Currently the certificates are the only guarantee we have that data has not been tampered with in-flight. I promise that we're trying to get this resolved, but we refuse to do it in a way which opens the door to the risk of someone using rustup as a way to deliver malware through corporate proxies.

GrumpyMetalGuy commented 5 years ago

Understood, and thanks for the update. I definitely don't want hackery used, as if malware gets into our network, it would look terrible for all involved!

I know you can't give estimates, etc, but as one of many behind the Great Corporate Firewall™, I really hope this gets some prioritisation/traction! I want Rust to take off across all environments, mine in particular ;) Especially with all the news from MS, FB, etc, starting to sing its praises more, it seems like a real shame to not actually be able to demo code using it...

RalfJung commented 5 years ago

Unable to download behind corporate proxy

So "corporate" is a synonym for "MITM that breaks security"? Wow, and I thought I was cynical. ;)

On a more serious note, the title could need some clarification that this is about proxies that do actively work against security best practices.

swigger commented 5 years ago

Unable to download behind corporate proxy

So "corporate" is a synonym for "MITM that breaks security"? Wow, and I thought I was cynical. ;)

On a more serious note, the title could need some clarification that this is about proxies that do actively work against security best practices.

NO, it means speed. For my MITM proxy, It's 50 times faster .

RalfJung commented 5 years ago

NO, it means speed. For my MITM proxy, It's 50 times faster .

Sure, fast -- but insecure. Such proxies are time and time again found to reduce security on the web and prevent deployment of new protocols like TLS 1.3. We would literally have had TLS 1.3 at least a year earlier if it wasn't for such proxies.

GrumpyMetalGuy commented 4 years ago

Hi, coming up to a year since the last comment. @kinnison , is there any news on this?

rbtcollins commented 4 years ago

Rather than turning off certificate verification, you should be able to add your MITM proxies root certificate to your local trust store; then traffic through it, and only traffic through it, will validate, other devices trying to attack your traffic will fail to validate.

That should not require any changes to rustup at all; please verify if this does / doesn't work, and we'll proceed from there.