
    @OOfV                        d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlm Z  d dlmZ! dZ"ejF                  jH                   e%ejF                  dd       z  Z& G d de      Z'dejP                  de)e*   defdZ+ G d d      Z,de-dej\                  fdZ/y)    N)Path)Any)	TypedDict)H3_ALPN)CipherSuite)x509)crypto)SSL)certs)
connection)ctx)
exceptions)tls)CONF_BASENAME)context)modes)quic)zECDHE-ECDSA-AES128-GCM-SHA256zECDHE-RSA-AES128-GCM-SHA256zECDHE-ECDSA-AES256-GCM-SHA384zECDHE-RSA-AES256-GCM-SHA384zECDHE-ECDSA-CHACHA20-POLY1305zECDHE-RSA-CHACHA20-POLY1305zDHE-RSA-AES128-GCM-SHA256zDHE-RSA-AES256-GCM-SHA384zDHE-RSA-CHACHA20-POLY1305zECDHE-ECDSA-AES128-SHA256zECDHE-RSA-AES128-SHA256zECDHE-ECDSA-AES128-SHAzECDHE-RSA-AES128-SHAzECDHE-ECDSA-AES256-SHA384zECDHE-RSA-AES256-SHA384zECDHE-ECDSA-AES256-SHAzECDHE-RSA-AES256-SHAzDHE-RSA-AES128-SHA256zDHE-RSA-AES256-SHA256zAES128-GCM-SHA256zAES256-GCM-SHA384zAES128-SHA256zAES256-SHA256z
AES128-SHAz
AES256-SHAzDES-CBC3-SHA#X509_CHECK_FLAG_NEVER_CHECK_SUBJECTc                   8    e Zd ZU edz  ed<   edz  ed<   eed<   y)AppDataNclient_alpnserver_alpnhttp2)__name__
__module____qualname__bytes__annotations__bool     [/var/www/premiumrankchecker/venv/lib/python3.12/site-packages/mitmproxy/addons/tlsconfig.pyr   r   B   s    Kr!   r   connoptionsreturnc                 ,   | j                         }|d   }|d   }|d   }|||v r|S t        j                  S |r||v r|S |dk(  rt        j                  S |rt        j                  nt        j
                  }|D ]
  }||v s|c S  t        j                  S )Nr   r   r   r!   )get_app_datar
   NO_OVERLAPPING_PROTOCOLS	proxy_tls
HTTP_ALPNSHTTP1_ALPNS)r#   r$   app_datar   r   r   
http_alpnsalpns           r"   alpn_select_callbackr/   H   s    ))+H=)K=)KWE'!///{g-c +++).%%I4I4IJ ,:K, +++r!   c                   .   e Zd ZU dZdZej                  ed<   d Zde	j                  fdZde	j                  ddfd	Zde	j                  ddfd
Zdej                   ddfdZdej                   ddfdZd Zd Zdej,                  dej.                  fdZy)	TlsConfigzj
    This addon supplies the proxy core with the desired OpenSSL connection objects to negotiate TLS.
    N	certstorec           	      \   |j                  dt        t        j                  j                  t        j
                  D cg c]  }|j                   c}d       |j                  dt        t        j                  j                  t        j
                  D cg c]  }|j                   c}d       |j                  dt        t        j                  j                  t        j
                  D cg c]  }|j                   c}d       |j                  dt        t        j                  j                  t        j
                  D cg c]  }|j                   c}d	       |j                  d
t        d z  d d       |j                  dt        d z  d d       y c c}w c c}w c c}w c c}w )Ntls_version_client_minz3Set the minimum TLS version for client connections.)nametypespecdefaultchoiceshelptls_version_client_maxz3Set the maximum TLS version for client connections.tls_version_server_minz3Set the minimum TLS version for server connections.tls_version_server_maxz3Set the maximum TLS version for server connections.tls_ecdh_curve_clientzUse a specific elliptic curve for ECDHE key exchange on client connections. OpenSSL syntax, for example "prime256v1" (see `openssl ecparam -list_curves`).)r5   r6   r7   r9   tls_ecdh_curve_serverzUse a specific elliptic curve for ECDHE key exchange on server connections. OpenSSL syntax, for example "prime256v1" (see `openssl ecparam -list_curves`).)
add_optionstrnet_tlsDEFAULT_MIN_VERSIONr5   VersionDEFAULT_MAX_VERSION)selfloaderxs      r"   loadzTlsConfig.loadv   sp   )//44%,__5QVV5F 	 	
 	)//44%,__5QVV5F 	 	
 	)//44%,__5QVV5F 	 	
 	)//44%,__5QVV5F 	 	
 	(4Z]	 	 	
 	(4Z]	 	 	
? 6 6 6 6s   FF-F$F)tls_clienthelloc                     |j                   }|j                  j                  xr t        j                  j
                  dk(  |_        y )Neager)r   serverr   r   r$   connection_strategyestablish_server_tls_first)rE   rI   conn_contexts      r"   rI   zTlsConfig.tls_clienthello   s8    &..##R(G(G7(R 	2r!   	tls_startr%   c                    |j                   yt        |j                  t        j                        sJ |j                  }|j
                  j                  }| j                  |j
                        }|j                  sHt        j                  j                  r.t        j                  j                  j                  d      |_        |j                  xs t        }t        j                  j                  r|j                  }ng }t!        j"                  |j$                  rt         j&                  j(                  nt         j&                  j*                  t         j,                  t        j                  j.                     t         j,                  t        j                  j0                     t3        |      t        j                  j4                  |j6                  dt8        t3        |      | j:                  j<                  
      }t?        j@                  |      |_         |j                   jC                  |jD                  jG                                |j                   jI                  tJ        jL                  jO                  |jP                               tS        |j
                  jT                        dk(  r4t        |j
                  jT                  d   tV        jX                        rd}n|jZ                  }|j                   j]                  t_        ||jZ                  t        j                  j`                               |j                   jc                          y)	z/Establish TLS or DTLS between client and proxy.N:F)
methodmin_versionmax_versioncipher_list
ecdh_curve
chain_filerequest_client_certr/   extra_chain_certsdhparams   r   s   http/1.1)r   r   r   )2ssl_conn
isinstancer#   r   Clientr   rL   get_certrV   r   r$   ciphers_clientsplitDEFAULT_CIPHERS"add_upstream_certs_to_client_chaincertificate_listrA   create_client_proxy_contextis_dtlsMethodDTLS_SERVER_METHODTLS_SERVER_METHODrC   r4   r:   tupler=   rX   r/   r2   r[   r
   
Connectionuse_certificatecertto_pyopenssluse_privatekeyr	   PKeyfrom_cryptography_key
privatekeylenlayersr   	HttpProxyr.   set_app_datar   r   set_accept_state)	rE   rP   clientrL   entryrV   rZ   ssl_ctxr   s	            r"   tls_start_clientzTlsConfig.tls_start_client   sH   ))..**;*;<<<$-NN$-$5$5$<$<i//0!!ckk&@&@!$!;!;!A!A#!FF((;O;;99 & 7 7 "55   >>4411(J(JK(J(JKk*{{88'' %!5#$56^^,,
 !^^G4	**5::+B+B+DE))KK--e.>.>?	
 y  ''(A-*$$Q'3
 )4K ++K'''"KKkk''	
 	++-r!   c                 Z   |j                   yt        |j                  t        j                        sJ |j
                  j                  }|j                  }|j                  sJ t        j                  j                  rt        j                  j                  }nt        j                  j                  }|j                  "|j                  xs |j                  d   |_        |j                   sj|j                   rWt        j                  j"                  rt%        |j                         |_        n)t%        d |j                   D              |_        ng |_        |j&                  sHt        j                  j(                  r.t        j                  j(                  j+                  d      |_        |j&                  xs t,        }d}t        j                  j.                  rt0        j2                  j5                  t        j                  j.                        }t0        j2                  j7                  |      r|}na|j                  xs |j                  d   }t0        j2                  j9                  || d      }	t0        j2                  j7                  |	      r|	}t        j:                  |j<                  rt        j>                  j@                  nt        j>                  jB                  t        jD                  t        j                  jF                     t        jD                  t        j                  jH                     t%        |      t        j                  jJ                  |t        j                  jL                  t        j                  jN                  |t        j                  j                  
      }
tQ        jR                  |
      |_         |j                  rt        |j                  tT              sJ tP        jV                  jY                  |j                   jZ                        }tP        jV                  j]                  |t^               	 ta        jb                  |j                        jd                  }tP        jV                  jg                  ||ti        |            }tQ        jj                  |dk(         n'|t        j                  j                  urtm        d	      |j                   r%|j                   ju                  |j                          |j                   jw                          y# tl        $ r{ |j                  jo                  d      }|j                   jq                  |       tP        jV                  js                  ||ti        |            }tQ        jj                  |dk(         Y w xY w)
z/Establish TLS or DTLS between proxy and server.Nr   c              3   ,   K   | ]  }|d k7  s	|  yw)s   h2Nr    .0rG   s     r"   	<genexpr>z-TlsConfig.tls_start_server.<locals>.<genexpr>  s      /e/s   
rR   z.pem)
rS   rT   rU   rV   rW   verifyca_path
ca_pemfileclient_certlegacy_server_connect   idnaz0Cannot validate certificate hostname without SNI)<r]   r^   r#   r   Serverr   ry   addressr   r$   ssl_insecurerA   VerifyVERIFY_NONEVERIFY_PEERsnialpn_offersr   rk   rV   ciphers_serverrb   rc   client_certsospath
expanduserisfilejoincreate_proxy_server_contextrg   rh   DTLS_CLIENT_METHODTLS_CLIENT_METHODrC   r;   r<   r>   #ssl_verify_upstream_trusted_confdirssl_verify_upstream_trusted_car
   rl   r@   _libSSL_get0_param_sslX509_VERIFY_PARAM_set_hostflagsDEFAULT_HOSTFLAGS	ipaddress
ip_addresspackedX509_VERIFY_PARAM_set1_iprt   _openssl_assert
ValueErrorencodeset_tlsext_host_nameX509_VERIFY_PARAM_set1_hostset_alpn_protosset_connect_state)rE   rP   ry   rL   r   rV   r   r   server_namepr{   paramipok	host_names                  r"   tls_start_serverzTlsConfig.tls_start_server   s   ))..**;*;<<<$-$5$5$<$<$-NN~~~;;##^^//F^^//F::8v~~a'8FJ!!!!;;$$ */v/A/A)BF&). /#)#5#5/ *F& &("!!ckk&@&@!$!;!;!A!A#!FF((;O"&;;##77--ckk.F.FGLww~~l+*#)::#B1BGGLL+d/CD77>>!$"#K55   >>4411(J(JK(J(JKk*{{88KKCC{{AA#"%++":":
 !^^G4	::fjj#... HH++I,>,>,C,CDE HH44U<MN-%00<CC XX77r3r7K##B!G,7>>555OPP..v/A/AB,,.%  -"JJ--f5	""77	BXX999c)n ##B!G,-s   )T& &BV*)V*c                 f   |j                   yt        j                         |_         t        |j                  t
        j                        sJ |j                  }|j                  j                  }| j                  |j                        }|j                  sHt        j                  j                  r.t        j                  j                  j                  d      |_
        t        j                  j                  r|j                   }ng }|j                  r0|j                  D cg c]  }t"        |    c}|j                   _        |j&                  |j&                  fD cg c]  }|s|	 c}xs |j(                  D cg c]  }|j+                  d       c}|j                   _        |j.                  j0                  |j                   _        |j4                  |j                   _        g |j8                  |D cg c]  }|j0                   c}|j                   _        yc c}w c c}w c c}w c c}w )z(Establish QUIC between client and proxy.NrR   ascii)settingsr   QuicTlsSettingsr^   r#   r   r_   r   rL   r`   rV   r   r$   ra   rb   rd   re   r   cipher_suitesr.   r   decodealpn_protocolsrn   _certcertificaters   certificate_private_keychain_certscertificate_chain)	rE   rP   ry   rL   rz   rZ   cipherr.   rn   s	            r"   quic_start_clientzTlsConfig.quic_start_clientO  s   )!113	 )..**;*;<<<$-NN$-$5$5$<$<i//0!!ckk&@&@!$!;!;!A!A#!FF;;99 & 7 7 " 282D2D0(.F#0I, ,2;;*DM$M "!!-
 KK -
	) */)9)9	&5:5E5E	2#KU%6%6#K9J#K0
DJJ0
	,0 N-
0
s   !HH$%H$<H)9H.c                    |j                   yt        j                         |_         t        |j                  t
        j                        sJ |j                  j                  }|j                  }|j                  sJ t        j                  j                  r t        j                  |j                   _        nt        j                   |j                   _        |j"                  "|j"                  xs |j                  d   |_        |j$                  sB|j$                  rt'        |j$                        |_        nt'        d t(        D              |_        |j*                  sHt        j                  j,                  r.t        j                  j,                  j/                  d      |_        |j*                  r0|j*                  D cg c]  }t0        |    c}|j                   _        |j$                  r8|j$                  D cg c]  }|j5                  d       c}|j                   _        t        j                  j8                  |j                   _        t        j                  j<                  |j                   _        yc c}w c c}w )z(Establish QUIC between proxy and server.Nr   c              3   >   K   | ]  }|j                  d         yw)r   N)r   )r   r.   s     r"   r   z.TlsConfig.quic_start_server.<locals>.<genexpr>  s     *TD4;;w+?*Ts   rR   r   ) r   r   r   r^   r#   r   r   r   ry   r   r   r$   r   ssl	CERT_NONEverify_modeCERT_REQUIREDr   r   rk   r   rV   r   rb   r   r   r   r   r   r   r   ca_file)rE   rP   ry   rL   r   r.   s         r"   quic_start_serverzTlsConfig.quic_start_serverx  s   )!113	 )..**;*;<<<$-$5$5$<$<$-NN~~~;;##-0]]I*-0->->I*::8v~~a'8FJ!!!!%*6+=+=%>" &+*TG*T%T"!!ckk&@&@!$!;!;!A!A#!FF 282D2D0(.F#0I, 171C1C1)-G$1I- &)[[%T%T	"%([[%O%O	"01s    I9<I>c                 &    | j                  d       y )Nconfdir)	configure)rE   s    r"   runningzTlsConfig.running  s     	y!r!   c                 V   d|v sd|v s	d|v sd|v rt         j                  j                  t        j                  j
                        }t        j                  j                  |t        t        j                  j                  t        j                  j                  r)t        j                  j                  j                  d      nd       | _        | j                  j                  j                         rt!        j"                  d       t        j                  j                  D ]  }|j%                  dd	      }t'        |      d	k(  rd
|d   g}t)        |d	         j                         }|j+                         st-        j.                  d|       	 | j                  j1                  |d   |t        j                  j                  r)t        j                  j                  j                  d      nd         d|v sd|v rSt        j                  j4                  t        j                  j6                  fD ]  }|	 t9        j:                  |        y y # t2        $ r!}t-        j.                  d| d|       |d }~ww xY w# t<        $ r}t-        j.                  d|      |d }~ww xY w)Nr   r   key_sizecert_passphraseutf8)r   basenamer   
passphrasea  The mitmproxy certificate authority has expired!
Please delete all CA-related files in your ~/.mitmproxy folder.
The CA will be regenerated automatically after restarting mitmproxy.
See https://docs.mitmproxy.org/stable/concepts-certificates/ for additional help.=r   *r   z!Certificate file does not exist: )r   zInvalid certificate format for z: r=   r>   zInvalid ECDH curve: )r   r   r   r   r$   r   r   	CertStore
from_storer   r   r   r   r2   
default_cahas_expiredloggingwarningrb   rt   r   existsr   OptionsErroradd_cert_filer   r=   r>   r	   get_elliptic_curve	Exception)rE   updatedcertstore_pathcertspecpartsrn   erW   s           r"   r   zTlsConfig.configure  sX   wG#W$ G+WW//0C0CDN"__77#&--;;.. ;;66==fE 8 DN ~~((446h  KK--  sA.u:? %(OEE!H~002{{}$11;D6B NN00a;;66 $';;#>#>#E#Ef#M! 1 . #g-1HG1S1111 
!
 )!11*=
! 2T " $119$r!E % !(552:.A !!s1   A$I;J	I>I99I>	J(
J##J(rO   c                 x   g }d}t         j                  j                  r|j                  j                  r||j                  j                  d   }|j
                  r$|j                  t        |j
                               |j                  |j                         |j                  r|j                  }|j                  j                  r/|j                  t        |j                  j                               n1|j                  t        |j                  j                  d                |j                  j                  r1|j                  t        |j                  j                  d                t        t         j#                  |            }t%        d |D        d      }| j&                  j)                  |||      S )z
        This function determines the Common Name (CN), Subject Alternative Names (SANs) and Organization Name
        our certificate should have and then fetches a matching cert from the certstore.
        Nr   c              3   F   K   | ]  }t        |j                          y w)N)r@   valuer   s     r"   r   z%TlsConfig.get_cert.<locals>.<genexpr>  s     2A3qww<2s   !)r   r$   upstream_certrL   re   cnappend_ip_or_dns_nameextendaltnamesorganizationry   r   socknamer   listdictfromkeysnextr2   r`   )rE   rO   r   r   r   r   s         r"   r`   zTlsConfig.get_cert  sL   
 ,.#' ;;$$)<)<)M)M(//@@CM0@0@ ABOOM223)),99 ""OOOL,?,?,C,CDEOOOL,?,?,H,H,KLM &&OOOL,?,?,G,G,JKL h/0 22D9~~&&r8\BBr!   )r   r   r   __doc__r2   r   r   r   rH   r   ClientHelloDatarI   TlsDatar|   r   r   QuicTlsDatar   r   r   r   r   ContextCertStoreEntryr`   r    r!   r"   r1   r1   a   s     "&Iu% *
X
s/B/B 
=.#++ =.$ =.~f/#++ f/$ f/P'
4+;+; '
 '
R,P4+;+; ,P ,P\"
:!x!CW__ !C9M9M !Cr!   r1   valc                     	 t        j                  |       }t        j                  |      S # t        $ r5 t        j
                  | j                  d      j                               cY S w xY w)zFConvert a string into either an x509.IPAddress or x509.DNSName object.r   )r   r   r   	IPAddressr   DNSNamer   r   )r   r   s     r"   r   r     sZ    "!!#& ~~b!!  9||CJJv.557889s   , ;A*)A*)0r   r   r   r   pathlibr   typingr   r   aioquic.h3.connectionr   aioquic.tlsr   cryptographyr   OpenSSLr	   r
   	mitmproxyr   r   r   r   r   mitmproxy.netrA   mitmproxy.optionsr   mitmproxy.proxyr   mitmproxy.proxy.layersr   r   r)   rc   r   $X509_CHECK_FLAG_NO_PARTIAL_WILDCARDSgetattrr   r   rl   r   r   r/   r1   r@   GeneralNamer   r    r!   r"   <module>r     s      	 
    ) #           ( + # ( ' 3
> HH11chh=qAB i ,s~~ ,U , ,2gC gCT" "!1!1 "r!   