{"action":"created","issue":{"url":"https://api.github.com/repos/mike820324/microProxy/issues/78","repository_url":"https://api.github.com/repos/mike820324/microProxy","labels_url":"https://api.github.com/repos/mike820324/microProxy/issues/78/labels{/name}","comments_url":"https://api.github.com/repos/mike820324/microProxy/issues/78/comments","events_url":"https://api.github.com/repos/mike820324/microProxy/issues/78/events","html_url":"https://github.com/mike820324/microProxy/issues/78","id":162605869,"number":78,"title":"TLS on HTTP2 Occured Error","user":{"login":"chhsiao90","id":10794200,"avatar_url":"https://avatars.githubusercontent.com/u/10794200?v=3","gravatar_id":"","url":"https://api.github.com/users/chhsiao90","html_url":"https://github.com/chhsiao90","followers_url":"https://api.github.com/users/chhsiao90/followers","following_url":"https://api.github.com/users/chhsiao90/following{/other_user}","gists_url":"https://api.github.com/users/chhsiao90/gists{/gist_id}","starred_url":"https://api.github.com/users/chhsiao90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chhsiao90/subscriptions","organizations_url":"https://api.github.com/users/chhsiao90/orgs","repos_url":"https://api.github.com/users/chhsiao90/repos","events_url":"https://api.github.com/users/chhsiao90/events{/privacy}","received_events_url":"https://api.github.com/users/chhsiao90/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mike820324/microProxy/labels/in%20progress","name":"in progress","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"chhsiao90","id":10794200,"avatar_url":"https://avatars.githubusercontent.com/u/10794200?v=3","gravatar_id":"","url":"https://api.github.com/users/chhsiao90","html_url":"https://github.com/chhsiao90","followers_url":"https://api.github.com/users/chhsiao90/followers","following_url":"https://api.github.com/users/chhsiao90/following{/other_user}","gists_url":"https://api.github.com/users/chhsiao90/gists{/gist_id}","starred_url":"https://api.github.com/users/chhsiao90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chhsiao90/subscriptions","organizations_url":"https://api.github.com/users/chhsiao90/orgs","repos_url":"https://api.github.com/users/chhsiao90/repos","events_url":"https://api.github.com/users/chhsiao90/events{/privacy}","received_events_url":"https://api.github.com/users/chhsiao90/received_events","type":"User","site_admin":false},"assignees":[{"login":"chhsiao90","id":10794200,"avatar_url":"https://avatars.githubusercontent.com/u/10794200?v=3","gravatar_id":"","url":"https://api.github.com/users/chhsiao90","html_url":"https://github.com/chhsiao90","followers_url":"https://api.github.com/users/chhsiao90/followers","following_url":"https://api.github.com/users/chhsiao90/following{/other_user}","gists_url":"https://api.github.com/users/chhsiao90/gists{/gist_id}","starred_url":"https://api.github.com/users/chhsiao90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chhsiao90/subscriptions","organizations_url":"https://api.github.com/users/chhsiao90/orgs","repos_url":"https://api.github.com/users/chhsiao90/repos","events_url":"https://api.github.com/users/chhsiao90/events{/privacy}","received_events_url":"https://api.github.com/users/chhsiao90/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-06-28T05:33:48Z","updated_at":"2016-06-28T05:50:32Z","closed_at":null,"body":"We found that if we enabled http2, and try forward the traffic to ForwardLayer, the socket will closed unexpectedly after handshaking.\r\nAnd the problem is caused by that http2 layer will check the tls cipher method, if it's not a safe cipher(in black list), the client would choose close the connection. "},"comment":{"url":"https://api.github.com/repos/mike820324/microProxy/issues/comments/228954816","html_url":"https://github.com/mike820324/microProxy/issues/78#issuecomment-228954816","issue_url":"https://api.github.com/repos/mike820324/microProxy/issues/78","id":228954816,"user":{"login":"chhsiao90","id":10794200,"avatar_url":"https://avatars.githubusercontent.com/u/10794200?v=3","gravatar_id":"","url":"https://api.github.com/users/chhsiao90","html_url":"https://github.com/chhsiao90","followers_url":"https://api.github.com/users/chhsiao90/followers","following_url":"https://api.github.com/users/chhsiao90/following{/other_user}","gists_url":"https://api.github.com/users/chhsiao90/gists{/gist_id}","starred_url":"https://api.github.com/users/chhsiao90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chhsiao90/subscriptions","organizations_url":"https://api.github.com/users/chhsiao90/orgs","repos_url":"https://api.github.com/users/chhsiao90/repos","events_url":"https://api.github.com/users/chhsiao90/events{/privacy}","received_events_url":"https://api.github.com/users/chhsiao90/received_events","type":"User","site_admin":false},"created_at":"2016-06-28T05:50:32Z","updated_at":"2016-06-28T05:50:32Z","body":"BTW, here is my reference from mitmproxy\r\n\r\nmitmproxy/proxy/config.py\r\n```\r\n# We manually need to specify this, otherwise OpenSSL may select a non-HTTP2 cipher by default.\r\n# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.2.15&openssl=1.0.2&hsts=yes&profile=old\r\nDEFAULT_CLIENT_CIPHERS = \"ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-A\r\nES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDH\r\nE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-\r\nCBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD\r\n5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA\"\r\n```\r\n\r\nnetlib/tcp.py\r\n```\r\nsslversion_choices = {\r\n    \"all\": (SSL.SSLv23_METHOD, SSL_BASIC_OPTIONS),\r\n    # SSLv23_METHOD + NO_SSLv2 + NO_SSLv3 == TLS 1.0+\r\n    # TLSv1_METHOD would be TLS 1.0 only\r\n    \"secure\": (SSL.SSLv23_METHOD, (SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3 | SSL_BASIC_OPTIONS)),\r\n    \"SSLv2\": (SSL.SSLv2_METHOD, SSL_BASIC_OPTIONS),\r\n    \"SSLv3\": (SSL.SSLv3_METHOD, SSL_BASIC_OPTIONS),\r\n    \"TLSv1\": (SSL.TLSv1_METHOD, SSL_BASIC_OPTIONS),\r\n    \"TLSv1_1\": (SSL.TLSv1_1_METHOD, SSL_BASIC_OPTIONS),\r\n    \"TLSv1_2\": (SSL.TLSv1_2_METHOD, SSL_BASIC_OPTIONS),\r\n}\r\n```\r\n```python\r\nif cipher_list:\r\n    try:\r\n        context.set_cipher_list(cipher_list)\r\n        # TODO: maybe change this to with newer pyOpenSSL APIs\r\n        context.set_tmp_ecdh(OpenSSL.crypto.get_elliptic_curve('prime256v1'))\r\n    except SSL.Error as v:\r\n        raise TlsException(\"SSL cipher specification error: %s\" % str(v))\r\n```"}}
{"actor":{"display_login":"chhsiao90"}}