proxy not work

[iromise]

Just as the title shows. when I add proxy, the result won't show. I am sure that the http proxy is ok.

[tomato42]

you can't use cipherscan through proxy, it needs to be able to connect to the server under scan directly

[iromise]

so what dose this mean when using command ./cipherscan

EXAMPLES:
./cipherscan -starttls xmpp jabber.ccc.de:5222
./cipherscan -servername youtube.com youtube.com:443
./cipherscan -proxy myproxy.example.com:8080 youtube.com:443

[tomato42]

because it's from the time the script was a simple wrapper around openssl

[tomato42]

hmm, but that shouldn't actually make the results completely absent, just incomplete...

what happens when you connect to the server using ./openssl s_client -connect server_under_test:443 -proxy (...)? (run it in the cipherscan directory)

[iromise]

It works when I use openssl with proxy

➜  cipherscan git:(master) ✗ openssl s_client -proxy 127.0.0.1:8118 -connect google.com:443
CONNECTED(00000003)
depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = US, O = Google Trust Services, CN = Google Internet Authority G3
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = *.google.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=*.google.com
   i:/C=US/O=Google Trust Services/CN=Google Internet Authority G3
 1 s:/C=US/O=Google Trust Services/CN=Google Internet Authority G3
   i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign
---

[tomato42]

the ./ in command is important, it will run the openssl from local directory, not the system one, like using openssl does

cipherscan script defaults to the local one, it will use system one only if you specify it using OPENSSLBIN=$(which openssl) environment variable or -o option

[iromise]

sorry to miss the ./, when I use

➜  cipherscan git:(master) ✗ sudo ./openssl s_client -proxy 127.0.0.1:8118 -connect google.com:443
[sudo] password for iromise: 
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
CONNECTED(00000003)
HTTP CONNECT failed

then i copy the openssl.cnf to the dir /usr/local/ssl/(not exist when use this command), and then I do it again, but it seems dose not work..

➜  cipherscan git:(master) ✗ sudo ./openssl s_client -proxy 127.0.0.1:8118 -connect google.com:443
CONNECTED(00000003)
HTTP CONNECT failed
140414114629312:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available

and at last when I use -o option, it works

➜  cipherscan git:(master) ✗ ./cipherscan -o $(which openssl) -proxy 127.0.0.1:8118 google.com:443
...............
Target: google.com:443

prio  ciphersuite                    protocols              pubkey_size  signature_algoritm       trusted  ticket_hint  ocsp_staple  npn                   pfs
1     ECDHE-ECDSA-CHACHA20-POLY1305  TLSv1.2                256          sha256WithRSAEncryption  True     100800       False        grpc-exp,h2,http/1.1  X25519,253bits  None
2     ECDHE-ECDSA-AES128-GCM-SHA256  TLSv1.2                256          sha256WithRSAEncryption  True     100800       False        grpc-exp,h2,http/1.1  X25519,253bits  None
3     ECDHE-ECDSA-AES256-GCM-SHA384  TLSv1.2                256          sha256WithRSAEncryption  True     100800       False        grpc-exp,h2,http/1.1  X25519,253bits  None
4     ECDHE-ECDSA-AES128-SHA         TLSv1,TLSv1.1,TLSv1.2  256          sha256WithRSAEncryption  True     100800       False        grpc-exp,h2,http/1.1  X25519,253bits  None

I think it's better to say this in the help doc.

[tomato42]

any suggestion for the doc text?

[iromise]

As the default openssl won't work

➜  cipherscan git:(master) ✗ ./openssl version  
OpenSSL 1.0.2-chacha (1.0.2i-dev)

the following doc

-proxy proxyhost:port Connect to the scan target via specified proxy
                    (req. OpenSSL 1.1.0 or bundled OpenSSL)

could be

-proxy proxyhost:port Connect to the scan target via specified proxy
                    (req. OpenSSL 1.1.0, e.g. use -o option to set a proper version openssl)

[tomato42]

hmm, and you have some settings in the openssl.cnf that relate to proxy? (like username/password)

I'm assuming that the one you copied into the /usr/local/ssl/ was the system one? (i.e. one from /etc)

[iromise]

No, I do nothing about the openssl.cnf. It was the default one.

[tomato42]

maybe the openssl unnecessarily requires config file to be present for the proxy to work? I'd call that a bug...

[iromise]

May be...