Event hook for server connection failure

[EndUser509]

The current code that deals with errors when establishing the connection to the remote server lacks an event hook:

        if tls_clienthello.establish_server_tls_first and not self.context.server.tls_established:
            err = yield from self.start_server_tls()
            if err:
                yield commands.Log(f"Unable to establish TLS connection with server ({err}). "
                                   f"Trying to establish TLS with client anyway.")

An event hook would be handy because at this point one may want to:

• Kill the client connection
• If eager connections are used, re-establish a pass-through connection and send the captured client hello. Maybe the client can achieve a successful connection directly.
• Influence what 502 error message is sent to the server

So far I have encountered two type of servers where the above would have helped me:

• Servers that were in a totally broken state
• Servers that have an incompatible set of ciphers or old SSL version.

An error hook may be enough but for symmetry we may have a corresponding set of hooks that is also available for the client connection.

[mhils]

Yes, that's a good idea. I guess my question would be when you would expect this to be fired? Immediately after a successful TCP handshake, or only after a successful TLS handshake? Right now the server_connected hook is triggered right after TCP establishment (before TLS is even considered).

[EndUser509]

For my own purposes a tls_failed_server() hook would be enough if from there I can either kill the client connection or switch to pass-through. That hook should be fired in the code segment above when the error is detected I guess.
I have no concrete use cases for a tls_established-server() or tls_clienthello_server() right now but here are some ideas that come to my mind:

• Evaluating some TLS statistics for different servers in tls_established-server().
• Choosing a different HTTP version from the client in tls_clienthello_server() by altering the alpn.

Not very strong I admit. :)

[EndUser509]

Another idea after looking at #5157: The code of that PR could be moved to a hook that would be called with the client_hello message of both server and client and could alter the later if necessary. Maybe tls_clienthello_server() would be a suitable name for that.

[mhils]

See #5157 (comment) on why modifying ClientHellos won't work as expected (although it would be very nice indeed).

For my own purposes a tls_failed_server() hook would be enough if from there I can either kill the client connection or switch to pass-through.

You can switch to passthrough for the next connection, see https://github.com/mitmproxy/mitmproxy/blob/main/examples/contrib/tls_passthrough.py. Can you maybe describe your high-level use case to help me understand why you want those things? :)

[EndUser509]

For my own purposes a tls_failed_server() hook would be enough if from there I can either kill the client connection or switch to pass-through.

You can switch to passthrough for the next connection, see https://github.com/mitmproxy/mitmproxy/blob/main/examples/contrib/tls_passthrough.py. Can you maybe describe your high-level use case to help me understand why you want those things? :)

Currently you get a '502 Blabla' error displayed in a browser for mitmroxy'ed connections if the remote server fails to connect. That is the correct behavior for a proxy. I have three use cases that I want to try out:

1. I want to abort the connection. The page will fail to load without error in the client browser. If the page load was initiated by clicking on a link it will feel like clicking on the link fails.
2. I want to immediately pass-through the connection and do some appropriate logging. On the client browser one will see an error message that is generated locally, as if there was no proxy in between. Or the connection may succeed, for instance if the client and server agree on a cipher suite that openssl does not have.
3. I want to implement an auto-learning pass-through list, so when the server connection fails I want to remember it for the next time. This is what you commented above. In a script of mine I have already implemented a similar auto-learning list for sites that do not accept the mitm CA, I want to be able to extent that script to also learn servers that fail TLS connections. The first connection will print an error message.

For me the maximum that I could wish for is both 2 and 3.