496
95%
master: 60%

Ran 04 Nov 2015 10:26AM UTC

Jobs 3

Files 30

Run time 1min

Badge

Embed ▾

pending completion

Build # 496

Build Type

push

travis-ci

Committed by Maximilian Hils

Commit Message

fix certificate verification

This commit fixes netlib's optional (turned off by default)
certificate verification, which previously did not validate the
cert's host name. As it turns out, verifying the connection's host
name on an intercepting proxy is not really straightforward - if
we receive a connection in transparent mode without SNI, we have no
clue which hosts the client intends to connect to. There are two
basic approaches to solve this problem:

 1. Exactly mirror the host names presented by the server in the
    spoofed certificate presented to the client.
 2. Require the client to send the TLS Server Name Indication
    extension. While this does not work with older clients,
    we can validate the hostname on the proxy.

Approach 1 is problematic in mitmproxy's use case, as we may want
to deliberately divert connections without the client's knowledge.
As a consequence, we opt for approach 2. While mitmproxy does now
require a SNI value to be sent by the client if certificate
verification is turned on, we retain our ability to present
certificates to the client which are accepted with a maximum
likelihood.

Run Details

2755 of 2885 relevant lines covered (95.49%)

1.91 hits per line

Jobs

ID	Job ID	Ran	Coverage
1	496.1	04 Nov 2015 10:26AM UTC	95.01	Travis Job 496.1
2	496.2 (OPENSSL=1.0.2)	04 Nov 2015 10:27AM UTC	95.49	Travis Job 496.2
3	496.3	04 Nov 2015 10:26AM UTC		Travis Job 496.3

Source Files on build 496

Detailed source file information is not available for this build.

mitmproxy / netlib / 496
95%
master: 60%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 496

mitmproxy / netlib / 496 95% master: 60%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 496

mitmproxy / netlib / 496
95%
master: 60%

README BADGES
x