{"action":"created","issue":{"url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/588","labels_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/588/labels{/name}","comments_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/588/comments","events_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/588/events","html_url":"https://github.com/mitmproxy/mitmproxy/issues/588","id":78254203,"number":588,"title":"Cipher selection snafu on server that only accepts SSLv3 with RC4-SHA","user":{"login":"aGHz","id":623725,"avatar_url":"https://avatars.githubusercontent.com/u/623725?v=3","gravatar_id":"","url":"https://api.github.com/users/aGHz","html_url":"https://github.com/aGHz","followers_url":"https://api.github.com/users/aGHz/followers","following_url":"https://api.github.com/users/aGHz/following{/other_user}","gists_url":"https://api.github.com/users/aGHz/gists{/gist_id}","starred_url":"https://api.github.com/users/aGHz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aGHz/subscriptions","organizations_url":"https://api.github.com/users/aGHz/orgs","repos_url":"https://api.github.com/users/aGHz/repos","events_url":"https://api.github.com/users/aGHz/events{/privacy}","received_events_url":"https://api.github.com/users/aGHz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-19T21:19:00Z","updated_at":"2015-05-20T19:08:35Z","closed_at":null,"body":"### TL;DR\r\n\r\nWe need to specify `--ciphers-server 'RC4-SHA'` if we want to connect to this IIS server, `'ALL'` causes `ECONNRESET` when reading from the stream. However, using `'ALL'` in `openssl s_client` is able to negotiate into RC4-SHA just fine.\r\n\r\nNot entirely sure if there's any problem, as netlib seems to just pass the cipher list to OpenSSL, but I'm asking here in case anyone has any idea that I can't see.\r\n\r\nI'm also posting here instead of netlib because if there's no clear solution (we really don't want to force RC4-SHA on all our connections), I'm planning to make a PR to enable per-host cipher lists in the same way we have per-host client cert files. So I want to ask what you think about that\r\n\r\n### Details\r\n\r\nWe're using mitmdump to collect all traffic between our server and third-party servers, and we've encountered a strange situation. Unfortunately I can't share details but I'll try to provide complete diagnostics and can also perform any test you may need.\r\n\r\nThe remote is an IIS server that seems to understand nothing but SSLv3 with the RC4-SHA cipher. We've arrived at this conclusion using a combination of brute-forcing mitmdump parameters and `openssl s_client`.\r\n\r\nSo we enabled SSLv3 with `mitmdump --ssl-version-server all`, and then we could at least connect to the remote server. However, we're getting `ECONNRESET` when we try to read from the connection:\r\n```\r\n<ip>:60920: clientconnect\r\n<ip>:60920: request\r\n  -> CONNECT <remote domain>:443 HTTP/1.1\r\n<ip>:60920: Set new server address: <remote domain>:443\r\n<ip>:60920: serverconnect\r\n  -> <remote domain>:443\r\n------ setting ciphers to: ALL\r\n<ip>:60920: Received CONNECT request to SSL port. Upgrading to SSL...\r\n<ip>:60920: Establish SSL\r\n  -> with client\r\n  -> with server (sni: None)\r\n<ip>:60920: SNI received: <remote domain>\r\n<ip>:60920: (server reconnect follows)\r\n<ip>:60920: serverdisconnect\r\n  -> <remote domain>:443\r\n<ip>:60920: Set new server address: <remote domain>:443\r\n<ip>:60920: serverconnect\r\n  -> <remote domain>:443\r\n------ setting ciphers to: ALL\r\n<ip>:60920: Establish SSL\r\n  -> with server (sni: <remote domain>)\r\n<ip>:60920: Upgrade to SSL completed.\r\n<ip>:60920: request\r\n  -> GET <path> HTTP/1.1\r\n---------- server_conn.send\r\n---------- server_conn.send done\r\n~~~ from_stream\r\n~~~ read_response\r\n***** read_response\r\n!!!!!!!!!!! SSL.SysCallError\r\n!!!!!!!!!!! (104, 'ECONNRESET')\r\n<ip>:60920: error in server communication: NetLibSSLError('',)\r\n<ip>:60920: (server reconnect follows)\r\n<ip>:60920: serverdisconnect\r\n  -> <remote domain>:443\r\n<ip>:60920: Set new server address: <remote domain>:443\r\n<ip>:60920: serverconnect\r\n  -> <remote domain>:443\r\n------ setting ciphers to: ALL\r\n<ip>:60920: Establish SSL\r\n  -> with server (sni: <remote domain>)\r\n---------- server_conn.send\r\n---------- server_conn.send done\r\n~~~ from_stream\r\n~~~ read_response\r\n***** read_response\r\n!!!!!!!!!!! SSL.SysCallError\r\n!!!!!!!!!!! (104, 'ECONNRESET')\r\n<ip>:60920: error in server communication: NetLibSSLError('',)\r\n<ip>:60920: TCP connection closed unexpectedly.\r\n<ip> GET https://<remote domain><path>\r\n    accept: */*\r\n    host: <remote domain>\r\n    Connection: keep-alive\r\n\r\n << TCP connection closed unexpectedly.\r\n<ip>:60920: clientdisconnect\r\n<ip>:60920: serverdisconnect\r\n  -> <remote domain>:443\r\n```\r\n\r\nForcing the connection to use RC4-SHA with `mitmdump --ssl-version-server all --ciphers-server 'RC4-SHA'` works like a charm:\r\n```\r\n<ip>:61058: clientconnect\r\n<ip>:61058: request\r\n  -> CONNECT <remote domain>:443 HTTP/1.1\r\n<ip>:61058: Set new server address: <remote domain>:443\r\n<ip>:61058: serverconnect\r\n  -> <remote domain>:443\r\n------ setting ciphers to: RC4-SHA\r\n<ip>:61058: Received CONNECT request to SSL port. Upgrading to SSL...\r\n<ip>:61058: Establish SSL\r\n  -> with client\r\n  -> with server (sni: None)\r\n<ip>:61058: SNI received: <remote domain>\r\n<ip>:61058: (server reconnect follows)\r\n<ip>:61058: serverdisconnect\r\n  -> <remote domain>:443\r\n<ip>:61058: Set new server address: <remote domain>:443\r\n<ip>:61058: serverconnect\r\n  -> <remote domain>:443\r\n------ setting ciphers to: RC4-SHA\r\n<ip>:61058: Establish SSL\r\n  -> with server (sni: <remote domain>)\r\n<ip>:61058: Upgrade to SSL completed.\r\n<ip>:61058: request\r\n  -> GET <path> HTTP/1.1\r\n---------- server_conn.send\r\n---------- server_conn.send done\r\n~~~ from_stream\r\n~~~ read_response\r\n***** read_response\r\n***** read_response 1\r\n***** read_response 2\r\n***** read_response 3\r\n***** read_response 4\r\n***** read_response 5\r\n***** read_response 6\r\n~~~ read_response done\r\n~~~ HTTPResponse\r\n~~~ HTTPResponse done\r\n<ip>:61058: response\r\n  -> HTTP/1.1 200 OK\r\nPublishing request to <remote domain>\r\n<ip> GET https://<remote domain><path>\r\n    accept: */*\r\n    host: <remote domain>\r\n    Connection: keep-alive\r\n\r\n << 200 OK 30.42kB\r\n    Content-Length: 31147\r\n    Content-Type: text/xml\r\n    Server: Microsoft-IIS/7.0\r\n    X-Powered-By: ARR/2.5\r\n    X-Powered-By: ASP.NET\r\n    Date: Tue, 19 May 2015 21:02:54 GMT\r\n```\r\n\r\nAs far as I can tell, netlib does nothing more with the cipher list than send it over to openssl, but when I try `openssl s_client -connect <remote domain>:443 -ssl3 -cipher ALL` it seems to be negotiating the cipher just fine:\r\n```\r\nCONNECTED(00000003)\r\ndepth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2\r\nverify error:num=20:unable to get local issuer certificate\r\nverify return:0\r\n---\r\nCertificate chain\r\n 0 s:<snip>\r\n   i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - SHA256 - G2\r\n 1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - SHA256 - G2\r\n   i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA\r\n---\r\nServer certificate\r\n-----BEGIN CERTIFICATE-----\r\n<snip>\r\n-----END CERTIFICATE-----\r\nsubject=<snip>\r\nissuer=/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - SHA256 - G2\r\n---\r\nNo client certificate CA names sent\r\n---\r\nSSL handshake has read 2693 bytes and written 502 bytes\r\n---\r\nNew, TLSv1/SSLv3, Cipher is RC4-SHA\r\nServer public key is 2048 bit\r\nSecure Renegotiation IS supported\r\nCompression: NONE\r\nExpansion: NONE\r\nSSL-Session:\r\n    Protocol  : SSLv3\r\n    Cipher    : RC4-SHA\r\n    Session-ID: <snip>\r\n    Session-ID-ctx:\r\n    Master-Key: <snip>\r\n    Key-Arg   : None\r\n    PSK identity: None\r\n    PSK identity hint: None\r\n    SRP username: None\r\n    Start Time: 1432068374\r\n    Timeout   : 7200 (sec)\r\n    Verify return code: 20 (unable to get local issuer certificate)\r\n---\r\n```\r\n(and then manually send HTTP commands that work fine)."},"comment":{"url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/comments/103998978","html_url":"https://github.com/mitmproxy/mitmproxy/issues/588#issuecomment-103998978","issue_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/588","id":103998978,"user":{"login":"elitest","id":5925087,"avatar_url":"https://avatars.githubusercontent.com/u/5925087?v=3","gravatar_id":"","url":"https://api.github.com/users/elitest","html_url":"https://github.com/elitest","followers_url":"https://api.github.com/users/elitest/followers","following_url":"https://api.github.com/users/elitest/following{/other_user}","gists_url":"https://api.github.com/users/elitest/gists{/gist_id}","starred_url":"https://api.github.com/users/elitest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elitest/subscriptions","organizations_url":"https://api.github.com/users/elitest/orgs","repos_url":"https://api.github.com/users/elitest/repos","events_url":"https://api.github.com/users/elitest/events{/privacy}","received_events_url":"https://api.github.com/users/elitest/received_events","type":"User","site_admin":false},"created_at":"2015-05-20T19:08:35Z","updated_at":"2015-05-20T19:08:35Z","body":"According to [OpenSSL's](https://www.openssl.org/docs/apps/ciphers.html) cipher docs RC4-SHA is a part of the spec for SSL3 and TLS1.0.  There must be some weird protocol negotiation stuff going on maybe?"}}