Android emulator and -http-proxy option

[xeroxnir]

Hi, i'm having problems connecting the Android emulator to mitmproxy with the -http-proxy option. I installed the certificate as usual but when i try to connect the android emulator browser to an HTTPS site I keep getting the same error on event log in master version:
"SSL handshake error: The client may not trust the proxy's certificate.". And in the mitmproxy ubuntu repository version I get:
"SSL handshake error: (-1, 'Unexpected EOF').".

I've the same problem on an Ubuntu 12.04, Lubuntu 14.10 and Ubuntu 14.04. The first 2 are being run inside a VM. I also tried changing the host OS /etc/environment to use mitmproxy as proxy but I keep having the same problem. I tested intercepting the traffic Burp and worked.

Thanks,
Joaquin

[mhils]

Hi @zerokes,

sorry for the late reply - somehow missed this issue. Now, let's track this step by step:

1. HTTP works just fine?
2. What's displayed in the browser on the device?
3. Which Emulator version are you using? 4.4.2? If so, see certificate import in android 4.4.2 emulator #204

Cheers,
Max

[xeroxnir]

Hi, no problem:

1. Yes, HTTP works fine
2. Android default browser
3. I'm running 4.1.2 emulator
   I've been reading some of previous issues, I think it's related to [Error] 400 SSL Handshake Error #203. I've been able to proxy the emulator transparently using iptables so I avoided the issue but it's still a problem to be fix.

Regards,
Joaquín

[mhils]

Hi @zerokes,

I'll need to see if I can replicate this over the next few days. Thanks for replying so quickly.

Cheers,
Max

[filmaj]

For the record, the Android emulator does some really weird stuff when you use the -http-proxy flag with traffic going over any port other than 80.

See: https://github.com/android/platform_external_qemu/blob/master/proxy/proxy_http.c#L47-L54

From what I can tell with testing, it creates an HTTP CONNECT tunnel for any traffic other than running on port 80. This is why HTTP traffic is fine, but HTTPS (and in fact, any HTTP(S) traffic running on a non-standard port) is super funky.

Just an FYI. I've been struggling with this for a long time :(

[mhils]

Thanks for clarification, @filmaj.
HTTP CONNECT for non-http traffic seems fine for me - see http://tools.ietf.org/html/draft-luotonen-web-proxy-tunneling-01. mitmproxy expects HTTPS on ports 443/8443, and HTTP on all other ports. You could use --tcp/--ignore in master to mark certain ports as non-HTTP traffic and let them pass through.

Haven't gotten around to take a look at the emulator yet, sorry.