Commit 38a3bd84 authored by justcoding121's avatar justcoding121

use SNI for transparent Endpoint

parent 1a61213f
...@@ -218,14 +218,20 @@ namespace Titanium.Web.Proxy ...@@ -218,14 +218,20 @@ namespace Titanium.Web.Proxy
{ {
if (endPoint.EnableSsl) if (endPoint.EnableSsl)
{ {
var sslStream = new SslStream(clientStream); var clientSslHelloInfo = await HttpsTools.GetClientHelloInfo(clientStream);
clientStream = new CustomBufferedStream(sslStream, BufferSize);
//implement in future once SNI supported by SSL stream, for now use the same certificate if (clientSslHelloInfo != null)
var certificate = CertificateManager.CreateCertificate(endPoint.GenericCertificateName, false); {
var sslStream = new SslStream(clientStream);
clientStream = new CustomBufferedStream(sslStream, BufferSize);
string sniHostName = clientSslHelloInfo.Extensions.FirstOrDefault(x => x.Name == "server_name")?.Data;
//Successfully managed to authenticate the client using the fake certificate var certificate = CertificateManager.CreateCertificate(sniHostName ?? endPoint.GenericCertificateName, false);
await sslStream.AuthenticateAsServerAsync(certificate, false, SslProtocols.Tls, false);
//Successfully managed to authenticate the client using the fake certificate
await sslStream.AuthenticateAsServerAsync(certificate, false, SslProtocols.Tls, false);
}
//HTTPS server created - we can now decrypt the client's traffic //HTTPS server created - we can now decrypt the client's traffic
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment