Add mutual authentication capability

justcoding121 · justcoding121 · commit 65b923fb300c · 2016-06-04T00:41:31.000-04:00
diff --git a/Examples/Titanium.Web.Proxy.Examples.Basic/ProxyTestController.cs b/Examples/Titanium.Web.Proxy.Examples.Basic/ProxyTestController.cs
@@ -15,6 +15,7 @@ public void StartProxy()
             ProxyServer.BeforeRequest += OnRequest;
             ProxyServer.BeforeResponse += OnResponse;
             ProxyServer.ServerCertificateValidationCallback += OnCertificateValidation;
+            ProxyServer.ClientCertificateSelectionCallback += OnCertificateSelection;
 
             //Exclude Https addresses you don't want to proxy
             //Usefull for clients that use certificate pinning
@@ -129,13 +130,25 @@ public async Task OnResponse(object sender, SessionEventArgs e)
         /// </summary>
         /// <param name="sender"></param>
         /// <param name="e"></param>
-        public async Task OnCertificateValidation(object sender, CertificateValidationEventArgs e)
+        public Task OnCertificateValidation(object sender, CertificateValidationEventArgs e)
         {
             //set IsValid to true/false based on Certificate Errors
             if (e.SslPolicyErrors == System.Net.Security.SslPolicyErrors.None)
                 e.IsValid = true;
-            else
-                await e.Session.Ok("Cannot validate server certificate! Not safe to proceed.");
+
+            return Task.FromResult(0);
+        }
+
+        /// <summary>
+        /// Allows overriding default client certificate selection logic during mutual authentication
+        /// </summary>
+        /// <param name="sender"></param>
+        /// <param name="e"></param>
+        public Task OnCertificateSelection(object sender, CertificateSelectionEventArgs e)
+        {
+            //set e.clientCertificate to override
+
+            return Task.FromResult(0);
         }
     }
 }
diff --git a/README.md b/README.md
@@ -12,8 +12,11 @@ Features
 ========
 
 * Supports Http(s) and most features of HTTP 1.1 
-* Supports relaying of WebSockets
-* Supports script injection
+* Support redirect/block/update requests
+* Supports updating response
+* Safely relays WebSocket requests over Http
+* Support mutual SSL authentication
+* Fully asynchronous proxy
 
 Usage
 =====
@@ -35,6 +38,8 @@ Setup HTTP proxy:
 	    	ProxyServer.BeforeRequest += OnRequest;
             ProxyServer.BeforeResponse += OnResponse;
             ProxyServer.ServerCertificateValidationCallback += OnCertificateValidation;
+            ProxyServer.ClientCertificateSelectionCallback += OnCertificateSelection;
+
 
             //Exclude Https addresses you don't want to proxy
             //Usefull for clients that use certificate pinning
@@ -84,9 +89,7 @@ Setup HTTP proxy:
 ```
 Sample request and response event handlers
 
-```csharp
-		
-        //intecept & cancel, redirect or update requests
+```csharp		
         public async Task OnRequest(object sender, SessionEventArgs e)
         {
             Console.WriteLine(e.WebSession.Request.Url);
@@ -148,20 +151,27 @@ Sample request and response event handlers
             }
         }
 
-       
-        /// Allows overriding default certificate validation logic  
-        public async Task OnCertificateValidation(object sender, CertificateValidationEventArgs e)
+        /// Allows overriding default certificate validation logic
+        public Task OnCertificateValidation(object sender, CertificateValidationEventArgs e)
         {
             //set IsValid to true/false based on Certificate Errors
             if (e.SslPolicyErrors == System.Net.Security.SslPolicyErrors.None)
                 e.IsValid = true;
-            else
-                await e.Session.Ok("Cannot validate server certificate! Not safe to proceed.");
+
+            return Task.FromResult(0);
+        }
+
+        /// Allows overriding default client certificate selection logic during mutual authentication
+        public Task OnCertificateSelection(object sender, CertificateSelectionEventArgs e)
+        {
+            //set e.clientCertificate to override
+
+            return Task.FromResult(0);
         }
 ```
 Future roadmap
 ============
-* Support mutual authentication
+* Implement Kerberos/NTLM authentication over HTTP protocols for windows domain
 * Support Server Name Indication (SNI) for transparent endpoints
 * Support HTTP 2.0 
 
diff --git a/Titanium.Web.Proxy/EventArguments/CertificateSelectionEventArgs.cs b/Titanium.Web.Proxy/EventArguments/CertificateSelectionEventArgs.cs
@@ -0,0 +1,21 @@
+﻿using System;
+using System.Security.Cryptography.X509Certificates;
+
+namespace Titanium.Web.Proxy.EventArguments
+{
+    public class CertificateSelectionEventArgs : EventArgs, IDisposable
+    {
+        public object sender { get; internal set; }
+        public string targetHost { get; internal set; }
+        public X509CertificateCollection localCertificates { get; internal set; }
+        public X509Certificate remoteCertificate { get; internal set; }
+        public string[] acceptableIssuers { get; internal set; }
+
+        public X509Certificate clientCertificate { get; set; }
+
+        public void Dispose()
+        {
+            throw new NotImplementedException();
+        }
+    }
+}
diff --git a/Titanium.Web.Proxy/EventArguments/CertificateValidationEventArgs.cs b/Titanium.Web.Proxy/EventArguments/CertificateValidationEventArgs.cs
@@ -1,20 +1,11 @@
 ﻿using System;
-using System.Collections.Generic;
-using System.Linq;
 using System.Net.Security;
 using System.Security.Cryptography.X509Certificates;
-using System.Text;
-using System.Threading.Tasks;
-using Titanium.Web.Proxy.Http;
 
 namespace Titanium.Web.Proxy.EventArguments
 {
     public class CertificateValidationEventArgs : EventArgs, IDisposable
     {
-        public string HostName => Session.WebSession.Request.Host;
-
-        public SessionEventArgs Session { get; internal set; }
-
         public X509Certificate Certificate { get; internal set; }
         public X509Chain Chain { get; internal set; }
         public SslPolicyErrors SslPolicyErrors { get; internal set; }
diff --git a/Titanium.Web.Proxy/Helpers/CertificateManager.cs b/Titanium.Web.Proxy/Helpers/CertificateManager.cs
@@ -97,6 +97,7 @@ protected async virtual Task<X509Certificate2> CreateCertificate(X509Store store
                     cached.LastAccess = DateTime.Now;
                     return cached.Certificate;
                 }
+
                 X509Certificate2 certificate = null;
                 store.Open(OpenFlags.ReadWrite);
                 string certificateSubject = string.Format("CN={0}, O={1}", certificateName, Issuer);
diff --git a/Titanium.Web.Proxy/Models/ConnectRequest.cs b/Titanium.Web.Proxy/Models/ConnectRequest.cs
@@ -0,0 +1,11 @@
+﻿using System;
+using System.IO;
+
+namespace Titanium.Web.Proxy.Models
+{
+    internal class ConnectRequest
+    {
+        internal Stream Stream { get; set; }
+        internal Uri Uri { get; set; }
+    }
+}
diff --git a/Titanium.Web.Proxy/Network/CustomSslStream.cs b/Titanium.Web.Proxy/Network/CustomSslStream.cs
@@ -17,10 +17,10 @@ internal class CustomSslStream : SslStream
         /// <summary>
         /// Holds the current session
         /// </summary>
-        internal SessionEventArgs Session { get; set; }
+        internal object Param { get; set; }
 
-        internal CustomSslStream(Stream innerStream, bool leaveInnerStreamOpen, RemoteCertificateValidationCallback userCertificateValidationCallback) 
-            :base(innerStream, leaveInnerStreamOpen, userCertificateValidationCallback)
+        internal CustomSslStream(Stream innerStream, bool leaveInnerStreamOpen, RemoteCertificateValidationCallback userCertificateValidationCallback, LocalCertificateSelectionCallback clientCertificateSelectionCallback) 
+            :base(innerStream, leaveInnerStreamOpen, userCertificateValidationCallback, clientCertificateSelectionCallback)
         {
 
         }
diff --git a/Titanium.Web.Proxy/Network/TcpConnectionManager.cs b/Titanium.Web.Proxy/Network/TcpConnectionManager.cs
@@ -12,6 +12,7 @@
 using Titanium.Web.Proxy.Shared;
 using System.Security.Cryptography.X509Certificates;
 using Titanium.Web.Proxy.EventArguments;
+using Titanium.Web.Proxy.Models;
 
 namespace Titanium.Web.Proxy.Network
 {
@@ -38,7 +39,12 @@ internal class TcpConnectionManager
     {
         static Dictionary<string, List<TcpConnection>> connectionCache = new Dictionary<string, List<TcpConnection>>();
         static SemaphoreSlim connectionAccessLock = new SemaphoreSlim(1);
-        internal static async Task<TcpConnection> GetClient(SessionEventArgs sessionArgs, string hostname, int port, bool isHttps, Version version)
+
+        internal static async Task<TcpConnection> GetClient(string hostname, int port, bool isHttps, Version version)
+        {
+            return await GetClient(null, hostname, port, isHttps, version);
+        }
+        internal static async Task<TcpConnection> GetClient(ConnectRequest connectRequest, string hostname, int port, bool isHttps, Version version)
         {
             List<TcpConnection> cachedConnections = null;
             TcpConnection cached = null;
@@ -72,14 +78,14 @@ internal static async Task<TcpConnection> GetClient(SessionEventArgs sessionArgs
             }
 
             if (cached == null)
-                cached = await CreateClient(sessionArgs, hostname, port, isHttps, version).ConfigureAwait(false);
+                cached = await CreateClient(connectRequest, hostname, port, isHttps, version).ConfigureAwait(false);
 
 
             //just create one more preemptively
             if (cachedConnections == null || cachedConnections.Count() < 2)
             {
-                var task = CreateClient(sessionArgs, hostname, port, isHttps, version)
-                            .ContinueWith(async (x) => { if (x.Status == TaskStatus.RanToCompletion) await ReleaseClient(x.Result); });
+                    var task = CreateClient(connectRequest, hostname, port, isHttps, version)
+                                .ContinueWith(async (x) => { if (x.Status == TaskStatus.RanToCompletion) await ReleaseClient(x.Result); });
             }
 
             return cached;
@@ -90,7 +96,7 @@ internal static string GetConnectionKey(string hostname, int port, bool isHttps,
             return string.Format("{0}:{1}:{2}:{3}:{4}", hostname.ToLower(), port, isHttps, version.Major, version.Minor);
         }
 
-        private static async Task<TcpConnection> CreateClient(SessionEventArgs sessionArgs, string hostname, int port, bool isHttps, Version version)
+        private static async Task<TcpConnection> CreateClient(ConnectRequest connectRequest, string hostname, int port, bool isHttps, Version version)
         {
             TcpClient client;
             Stream stream;
@@ -106,8 +112,8 @@ private static async Task<TcpConnection> CreateClient(SessionEventArgs sessionAr
 
                     using (var writer = new StreamWriter(stream, Encoding.ASCII, Constants.BUFFER_SIZE, true))
                     {
-                        await writer.WriteLineAsync(string.Format("CONNECT {0}:{1} {2}", sessionArgs.WebSession.Request.RequestUri.Host, sessionArgs.WebSession.Request.RequestUri.Port, sessionArgs.WebSession.Request.HttpVersion)).ConfigureAwait(false);
-                        await writer.WriteLineAsync(string.Format("Host: {0}:{1}", sessionArgs.WebSession.Request.RequestUri.Host, sessionArgs.WebSession.Request.RequestUri.Port)).ConfigureAwait(false);
+                        await writer.WriteLineAsync(string.Format("CONNECT {0}:{1} {2}", hostname, port, version)).ConfigureAwait(false);
+                        await writer.WriteLineAsync(string.Format("Host: {0}:{1}", hostname, port)).ConfigureAwait(false);
                         await writer.WriteLineAsync("Connection: Keep-Alive").ConfigureAwait(false);
                         await writer.WriteLineAsync().ConfigureAwait(false);
                         await writer.FlushAsync().ConfigureAwait(false);
@@ -132,8 +138,9 @@ private static async Task<TcpConnection> CreateClient(SessionEventArgs sessionAr
 
                 try
                 {
-                    sslStream = new CustomSslStream(stream, true, new RemoteCertificateValidationCallback(ProxyServer.ValidateServerCertificate));
-                    sslStream.Session = sessionArgs;
+                    sslStream = new CustomSslStream(stream, true, new RemoteCertificateValidationCallback(ProxyServer.ValidateServerCertificate),
+                        new LocalCertificateSelectionCallback(ProxyServer.SelectClientCertificate));
+                    sslStream.Param  = connectRequest;
                     await sslStream.AuthenticateAsClientAsync(hostname, null, Constants.SupportedProtocols, false).ConfigureAwait(false);
                     stream = (Stream)sslStream;
                 }
diff --git a/Titanium.Web.Proxy/ProxyServer.cs b/Titanium.Web.Proxy/ProxyServer.cs
@@ -45,7 +45,16 @@ static ProxyServer()
         /// </summary>
         public static int CertificateCacheTimeOutMinutes { get; set; }
 
+
+        /// <summary>
+        /// Intercept request to server
+        /// </summary>
         public static event Func<object, SessionEventArgs, Task> BeforeRequest;
+
+
+        /// <summary>
+        /// Intercept response from server
+        /// </summary>
         public static event Func<object, SessionEventArgs, Task> BeforeResponse;
 
         /// <summary>
@@ -62,7 +71,11 @@ static ProxyServer()
         /// Verifies the remote Secure Sockets Layer (SSL) certificate used for authentication
         /// </summary>
         public static event Func<object, CertificateValidationEventArgs, Task> ServerCertificateValidationCallback;
-
+       
+        /// <summary>
+        /// Callback tooverride client certificate during SSL mutual authentication
+        /// </summary>
+        public static event Func<object, CertificateSelectionEventArgs, Task> ClientCertificateSelectionCallback;
 
         public static List<ProxyEndPoint> ProxyEndPoints { get; set; }
 
diff --git a/Titanium.Web.Proxy/RequestHandler.cs b/Titanium.Web.Proxy/RequestHandler.cs
diff --git a/Titanium.Web.Proxy/Titanium.Web.Proxy.csproj b/Titanium.Web.Proxy/Titanium.Web.Proxy.csproj

Original file line number	Diff line number	Diff line change
`@@ -97,6 +97,7 @@ protected async virtual Task<X509Certificate2> CreateCertificate(X509Store store`
`97`	`97`	`cached.LastAccess = DateTime.Now;`
`98`	`98`	`return cached.Certificate;`
`99`	`99`	`}`
	`100`	`+`
`100`	`101`	`X509Certificate2 certificate = null;`
`101`	`102`	`store.Open(OpenFlags.ReadWrite);`
`102`	`103`	`string certificateSubject = string.Format("CN={0}, O={1}", certificateName, Issuer);`
Original file line number	Diff line number	Diff line change
`@@ -17,10 +17,10 @@ internal class CustomSslStream : SslStream`
`17`	`17`	`/// <summary>`
`18`	`18`	`/// Holds the current session`
`19`	`19`	`/// </summary>`
`20`		`- internal SessionEventArgs Session { get; set; }`
	`20`	`+ internal object Param { get; set; }`
`21`	`21`
`22`		`- internal CustomSslStream(Stream innerStream, bool leaveInnerStreamOpen, RemoteCertificateValidationCallback userCertificateValidationCallback)`
`23`		`- :base(innerStream, leaveInnerStreamOpen, userCertificateValidationCallback)`
	`22`	`+ internal CustomSslStream(Stream innerStream, bool leaveInnerStreamOpen, RemoteCertificateValidationCallback userCertificateValidationCallback, LocalCertificateSelectionCallback clientCertificateSelectionCallback)`
	`23`	`+ :base(innerStream, leaveInnerStreamOpen, userCertificateValidationCallback, clientCertificateSelectionCallback)`
`24`	`24`	`{`
`25`	`25`
`26`	`26`	`}`
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@`
`12`	`12`	`using Titanium.Web.Proxy.Shared;`
`13`	`13`	`using System.Security.Cryptography.X509Certificates;`
`14`	`14`	`using Titanium.Web.Proxy.EventArguments;`
	`15`	`+using Titanium.Web.Proxy.Models;`
`15`	`16`
`16`	`17`	`namespace Titanium.Web.Proxy.Network`
`17`	`18`	`{`
`@@ -38,7 +39,12 @@ internal class TcpConnectionManager`
`38`	`39`	`{`
`39`	`40`	`static Dictionary<string, List<TcpConnection>> connectionCache = new Dictionary<string, List<TcpConnection>>();`
`40`	`41`	`static SemaphoreSlim connectionAccessLock = new SemaphoreSlim(1);`
`41`		`- internal static async Task<TcpConnection> GetClient(SessionEventArgs sessionArgs, string hostname, int port, bool isHttps, Version version)`
	`42`	`+`
	`43`	`+ internal static async Task<TcpConnection> GetClient(string hostname, int port, bool isHttps, Version version)`
	`44`	`+ {`
	`45`	`+ return await GetClient(null, hostname, port, isHttps, version);`
	`46`	`+ }`
	`47`	`+ internal static async Task<TcpConnection> GetClient(ConnectRequest connectRequest, string hostname, int port, bool isHttps, Version version)`
`42`	`48`	`{`
`43`	`49`	`List<TcpConnection> cachedConnections = null;`
`44`	`50`	`TcpConnection cached = null;`
`@@ -72,14 +78,14 @@ internal static async Task<TcpConnection> GetClient(SessionEventArgs sessionArgs`
`72`	`78`	`}`
`73`	`79`
`74`	`80`	`if (cached == null)`
`75`		`- cached = await CreateClient(sessionArgs, hostname, port, isHttps, version).ConfigureAwait(false);`
	`81`	`+ cached = await CreateClient(connectRequest, hostname, port, isHttps, version).ConfigureAwait(false);`
`76`	`82`
`77`	`83`
`78`	`84`	`//just create one more preemptively`
`79`	`85`	`if (cachedConnections == null \|\| cachedConnections.Count() < 2)`
`80`	`86`	`{`
`81`		`- var task = CreateClient(sessionArgs, hostname, port, isHttps, version)`
`82`		`- .ContinueWith(async (x) => { if (x.Status == TaskStatus.RanToCompletion) await ReleaseClient(x.Result); });`
	`87`	`+ var task = CreateClient(connectRequest, hostname, port, isHttps, version)`
	`88`	`+ .ContinueWith(async (x) => { if (x.Status == TaskStatus.RanToCompletion) await ReleaseClient(x.Result); });`
`83`	`89`	`}`
`84`	`90`
`85`	`91`	`return cached;`
`@@ -90,7 +96,7 @@ internal static string GetConnectionKey(string hostname, int port, bool isHttps,`
`90`	`96`	`return string.Format("{0}:{1}:{2}:{3}:{4}", hostname.ToLower(), port, isHttps, version.Major, version.Minor);`
`91`	`97`	`}`
`92`	`98`
`93`		`- private static async Task<TcpConnection> CreateClient(SessionEventArgs sessionArgs, string hostname, int port, bool isHttps, Version version)`
	`99`	`+ private static async Task<TcpConnection> CreateClient(ConnectRequest connectRequest, string hostname, int port, bool isHttps, Version version)`
`94`	`100`	`{`
`95`	`101`	`TcpClient client;`
`96`	`102`	`Stream stream;`
`@@ -106,8 +112,8 @@ private static async Task<TcpConnection> CreateClient(SessionEventArgs sessionAr`
`106`	`112`
`107`	`113`	`using (var writer = new StreamWriter(stream, Encoding.ASCII, Constants.BUFFER_SIZE, true))`
`108`	`114`	`{`
`109`		`- await writer.WriteLineAsync(string.Format("CONNECT {0}:{1} {2}", sessionArgs.WebSession.Request.RequestUri.Host, sessionArgs.WebSession.Request.RequestUri.Port, sessionArgs.WebSession.Request.HttpVersion)).ConfigureAwait(false);`
`110`		`- await writer.WriteLineAsync(string.Format("Host: {0}:{1}", sessionArgs.WebSession.Request.RequestUri.Host, sessionArgs.WebSession.Request.RequestUri.Port)).ConfigureAwait(false);`
	`115`	`+ await writer.WriteLineAsync(string.Format("CONNECT {0}:{1} {2}", hostname, port, version)).ConfigureAwait(false);`
	`116`	`+ await writer.WriteLineAsync(string.Format("Host: {0}:{1}", hostname, port)).ConfigureAwait(false);`
`111`	`117`	`await writer.WriteLineAsync("Connection: Keep-Alive").ConfigureAwait(false);`
`112`	`118`	`await writer.WriteLineAsync().ConfigureAwait(false);`
`113`	`119`	`await writer.FlushAsync().ConfigureAwait(false);`
`@@ -132,8 +138,9 @@ private static async Task<TcpConnection> CreateClient(SessionEventArgs sessionAr`
`132`	`138`
`133`	`139`	`try`
`134`	`140`	`{`
`135`		`- sslStream = new CustomSslStream(stream, true, new RemoteCertificateValidationCallback(ProxyServer.ValidateServerCertificate));`
`136`		`- sslStream.Session = sessionArgs;`
	`141`	`+ sslStream = new CustomSslStream(stream, true, new RemoteCertificateValidationCallback(ProxyServer.ValidateServerCertificate),`
	`142`	`+ new LocalCertificateSelectionCallback(ProxyServer.SelectClientCertificate));`
	`143`	`+ sslStream.Param = connectRequest;`
`137`	`144`	`await sslStream.AuthenticateAsClientAsync(hostname, null, Constants.SupportedProtocols, false).ConfigureAwait(false);`
`138`	`145`	`stream = (Stream)sslStream;`
`139`	`146`	`}`