Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use client-requested cipher suites for server connection and support anonymous suites #133

Open
droe opened this issue Apr 19, 2016 · 1 comment

Comments

@droe
Copy link
Owner

droe commented Apr 19, 2016

The cipher suites requested by the client should be used in the connection towards the server, as long as they can be handled by sslsplit and the version of OpenSSL that is in use. This idea came up in #126. This is a bit complex because we need to manually parse the cipher suites from the Client Hello message before creating the source SSL bufferevent in order to correctly configure the destination SSL bufferevent.

Support for anonymous cipher suites is currently untested and may or may not work. This should be tested (both ssl and autossl proxyspecs) and necessary fixes implemented so that when a client requests anonymous cipher suites, they are actually used.

@droe droe added this to the 0.5.1 milestone Apr 19, 2016
@crazy-william
Copy link

I research the API of openssl, do not find the appropriate function to set cipher list.
Only get this:
SSL_CTX_set_cipher_list
SSL_set_cipher_list
But they only set the whole cipher suites, not list.

@droe droe modified the milestones: 0.6.0, 0.5.1 Jul 10, 2016
@droe droe removed this from the 0.6.0 milestone Jan 3, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants