How to channel traffic from a docker container through mitmpoxy working on another container?

[trozhkov]

Hello! I want traffic from one container #1 to pass through mitmproxy #2 working on another container, but I have a problem with certificates.

I've tried copping the .cer file from my host machine into #1 container, so that it could allow https traffic to pass through #2 container.

COPY ./certificates/mitmproxy-ca-cert.cer /usr/local/share/ca-certificates/mitmproxy-ca-cert.crt RUN update-ca-certificates

But it doesn't seem to work. Where should put the .cer file? Should I install mitmproxy on #1 contaienr as well?

Errors I get:

Step 13/19 : RUN update-ca-certificates
 ---> Running in 299cb705aa19
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (35) error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding

[Prinzhorn]

I think it should be mitmproxy-ca-cert.pem not mitmproxy-ca-cert.cer judging from this

mitmproxy/mitmproxy/addons/onboardingapp/templates/index.html

Lines 49 to 52 in 90686ab

	<ol>
	<li><code>mv mitmproxy-ca-cert.pem /usr/local/share/ca-certificates/mitmproxy.crt</code></li>
	<li><code>sudo update-ca-certificates</code></li>
	</ol>

I've tried copping the .cer file from my host machine into #1 container

You also need to copy it to container 2, because otherwise your mitmproxy container will just generate a new one that does not match container 1.

[Prinzhorn]

In the mitmproxy container you need to put the certs in ~/.mitmproxy or wherever you set --confdir to. Your mitmproxy container still generates certificates that don't match whatever you've put into the curl container. At least from the little information you've provided. If that doesn't work you need to provide minimal steps to reproduce this, including two minimal Dockerfiles.

[trozhkov]

Let's try with the minimal example I guess because the '~/.mitmproxy' solution haven't worked for me

http-proxy.dockerfile

FROM ubuntu:20.04

RUN apt-get update && \
    apt-get install -y nano curl tmux python3 python3-venv pip nano && \
    pip install mitmproxy
COPY ./certificates/mitmproxy-ca-cert.pem .mitmproxy/mitmproxy-ca-cert.pem

RUN update-ca-certificates

CMD mitmproxy --set console_palette=lowdark -p 8888

curl-container.dockerfile

FROM ubuntu:20.04

# prints python output to the console
ENV DEBIAN_FRONTEND=noninteractive

EXPOSE 8000

RUN apt-get update && \
    apt-get install -y apt-utils curl python3 python3-pip python3.8-venv ca-certificates && \
    python3 -m venv /py
RUN mv ./certificates/mitmproxy-ca-cert.pem /usr/local/share/ca-certificates/mitmproxy-ca-cert.crt && \
    update-ca-certificates

RUN curl_request=$(curl https://docs.docker.com/network/proxy/) && echo $curl_request

RUN env | grep -i _PROXY

ENV PATH="/py/bin:$PATH"

certificates/mitmproxy-ca-cert.pem

-----BEGIN CERTIFICATE-----
MIIDNTCCAh2gAwIBAgIUMfkXVN7tfiHs7MitE2i0XT8CcJswDQYJKoZIhvcNAQEL
BQAwKDESMBAGA1UEAwwJbWl0bXByb3h5MRIwEAYDVQQKDAltaXRtcHJveHkwHhcN
MjMwNTA4MTE1MzM2WhcNMzMwNTA3MTE1MzM2WjAoMRIwEAYDVQQDDAltaXRtcHJv
eHkxEjAQBgNVBAoMCW1pdG1wcm94eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAMW/fFaFRc7RNNQ0dk8KfrhVB4oKNVAv+eybX3/J2I62UHCpD+D8EXvm
qJpy1JEbnL99d4pYS+QcFokxYBCTzWt2Yq5S9+wHmGCBnbG+PMZnh3apdoOHNvOB
T58x0wnXpYWs/Mhd939D2AjnTlg3ihBkllM5b6rUTenjDrkQKtzgkXS85lFUa9Xz
dwIk04ikJ/VOnLyNr5vsfOh41Ap6ShrlKxIgIKj9YeSrTYUvm2PVVLzKuVsOIMAo
AnYFMQMW40QqAw372ejEnWlaFYiJKjSxdnLbgtsuJjLuo7s8ky+kLQZGLQRcbobL
2SC5Nm/1Hauk9L5ty9ZWcenyE+00MfcCAwEAAaNXMFUwDwYDVR0TAQH/BAUwAwEB
/zATBgNVHSUEDDAKBggrBgEFBQcDATAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
FHsfNN40RTbCAetevh41jXqEmH0VMA0GCSqGSIb3DQEBCwUAA4IBAQAwpzZVZzCo
yQsA9+8rJw6r309avQ97+e3HeGes4dpBGjLY2caYInwuZHJcMNC8jj/GuxEQ5kpe
0a8NkWuykdknVWwPLpGZ4Zwalr0hcgqZkotWgWJ6zkTSK2fzFfo2SBiErmTnIk4P
FzvtgUoxV7fTYJlWEFZ2E6QObY4gor9qnt5WxCPFeY9TCLim9eBSeoMV4pwpF+iD
yfteF72QwFfVkdgoCW+qHXs73ctxo1Hn9saxVLiX1akGg4pDCaAAUQzrmKrUTvvt
VBu6dP33prRk/a7rUUZHJbZXrI3sEyFJ/0RBFzT/hOuh+M/ABt9bT6xKUdjQ/q95
lR02hioYpPJg
-----END CERTIFICATE-----

STEPS

1. build http-proxy container
2. try running requests via the proxy from the host machine, it actually should be enough for this example

export http_proxy=http://localhost:8888
export https_proxy=http://localhost:8888

so, now you can send curl requests like this curl http://worldtimeapi.org/api/timezone/America/New_York
and see them coming through the proxy, but if you try to modify this request for https, like this
curl https://worldtimeapi.org/api/timezone/America/New_York
there would be a problem.
3) mv ./certificates/mitmproxy-ca-cert.pem /usr/local/share/ca-certificates/mitmproxy-ca-cert.crt &&
update-ca-certificates
4) now the host (in theory should be apple to channel https requests through the proxy), tho in practice there's still an error

To channel the container traffic through the proxy use this for .docker/config.json

{
"auths": {
"https://index.docker.io/v1/": {
"auth": "your auth"
}
},
"proxies": {
"default": {
"httpProxy": "http://172.17.0.2:8888",
"httpsProxy": "https://172.17.0.2:8888",
"noProxy": ""
}
}
}

[trozhkov]

Now I've figured out I can use any pem file I want for my mitmproxy with this option
CMD mitmproxy --set console_palette=lowdark -p 8888 --certs "*=mitmproxy-ca-cert.pem"

But I still don't know how to make curl-container to use the same certificate to make curl requests. Where should I put it?

[trozhkov]

I've managed to generate the same .deb file for my curl-container at the location
/etc/ssl/certs/mitmproxy-ca-cert.pem

Which I thought should do the trick, but I still get the error:

curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to worldtimeapi.org:443

It's strange because it seems like now both containers are using the same certificate.. and yet there's still a problem

[trozhkov]

@Prinzhorn if you still can help me out, please do 🙏🙏 It's not like I can ask anybody else about it 😅