Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cert_passphrase has no effect when declared in config.yaml #6014

Open
Puliyo opened this issue Mar 26, 2023 · 5 comments · May be fixed by #6043
Open

cert_passphrase has no effect when declared in config.yaml #6014

Puliyo opened this issue Mar 26, 2023 · 5 comments · May be fixed by #6043
Labels
kind/triage Unclassified issues

Comments

@Puliyo
Copy link

Puliyo commented Mar 26, 2023 •
edited

Problem Description

The ca file is encrypted (pkcs8).

$ cat certs/mitmproxy-ca.pem
-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----
...

Declare cert_passphrase in config.yaml

$ cat certs/config.yaml
cert_passphrase: abcde

Run specifying the cert and yaml using "confdir" -> Fails

$ mitmdump -s test_addon.py --set confdir=./certs
[02:47:59.289] Addon error: Traceback (most recent call last):
  File "/home/ubuntu/venv/lib/python3.10/site-packages/mitmproxy/addons/tlsconfig.py", line 308, in configure
    self.certstore = certs.CertStore.from_store(
  File "/home/ubuntu/venv/lib/python3.10/site-packages/mitmproxy/certs.py", line 359, in from_store
    return cls.from_files(ca_file, dhparam_file, passphrase)
  File "/home/ubuntu/venv/lib/python3.10/site-packages/mitmproxy/certs.py", line 366, in from_files
    key = load_pem_private_key(raw, passphrase)
  File "/home/ubuntu/venv/lib/python3.10/site-packages/mitmproxy/certs.py", line 532, in load_pem_private_key
    return serialization.load_pem_private_key(data, password)  # type: ignore
  File "/home/ubuntu/venv/lib/python3.10/site-packages/cryptography/hazmat/primitives/serialization/base.py", line 22, in load_pem_private_key
    return ossl.load_pem_private_key(data, password)
  File "/home/ubuntu/venv/lib/python3.10/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 921, in load_pem_private_key
    return self._load_key(
  File "/home/ubuntu/venv/lib/python3.10/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1179, in _load_key
    raise TypeError(
TypeError: Password was not given but private key is encrypted

Remove cert_passphrase from config.yaml and include in options -> Works

$ mitmdump -s test_addon.py --set cert_passphrase="abcde" --set confdir=./certs
[02:57:59.102] Loading script test_addon.py
[02:57:59.138] HTTP(S) proxy listening at *:8080.

System Information

$ mitmproxy --version
Mitmproxy: 9.0.1
Python:    3.10.6
OpenSSL:   OpenSSL 3.0.7 1 Nov 2022
Platform:  Linux-5.15.0-1027-oracle-aarch64-with-glibc2.35
@Puliyo Puliyo added the kind/triage Unclassified issues label Mar 26, 2023
@Prinzhorn
Copy link
Member

Prinzhorn commented Mar 26, 2023 •
edited

Before digging into this, are you sure mitmdump -s test_addon.py --set cert_passphrase="abcde" is accessing the same cert? Because you didn't specify confdir, so this might just look like it's working, because it doesn't load the same cert as the other command? Although the error message is pretty clear.

@Puliyo
Copy link
Author

Puliyo commented Mar 26, 2023

My bad. Running mitmdump as part of something and accidentally removed confdir while simplifying.
I'm very certain the two runs are accessing the same cert.
I will edit the description.

@mhils
Copy link
Member

mhils commented Mar 26, 2023

This needs an example certificate to be reproducible.

@Puliyo
Copy link
Author

Puliyo commented Mar 27, 2023

Here's the example encrypted mitmproxy-ca.pem I just generated. Password is "abcde".

-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQI49dnqIOEGWMCAggA
MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBAF6Dv73EXmqph84L4fi4QfBIIE
0EB2Py3gk7M/58lhQJF7FJmSYV7W4eiPKQRxwyImHuLELzl4YfTCv3yg8ePvC0ft
ohevmlfT8ZnsoJqlEF1GPiwqU784OKaRFUWqwVQNKrkmUbuCiEUY7u3PrDbc2mGI
NruJpdlV5a9RaUc31O+kDQcpZObeTCFPPXywZDen9hdYiaNUQ6AjJID/JEepwSHi
4M9T+NBbtzV2BoHOXYNOEsGn7KlmSa0y8asj9PLHoY9qCd1H8vULDWU6XBRfwL2C
6zNWv2cvOtX11Tgsw6FgOil02eTs+YzCjOzBKNa+jrpjpB1f7bNF6o7FTm8VYqrm
wfLal/0n2CC5zJtXHkLRuf/Sn8iUVjNKhOkwLG8epjJ+zJVeeoMbw8T/aDkqORvw
ibU5PQny3P+Xy4wgTnoP6bdRLzdHHCd0uwTCGyTkPgrKAb7vWb+bOPEmeRd82kvv
0yP8CEwg5WZ7mvjHkJFvzGkhDcxW4SjAQX9AfitsFgakdaulKy/nRNIugHWWG6V3
g0aV12h2kvyFQIyt6G643bjy1ICtGlPLKQNJhGU3/9afE0pEYDZg8pacLhpduzUP
QEaz19IgoQ1+ajR2u4hRpM3Ky016cEMYZ59PY+yC3ON1yKlG/PRPOwMkmY3lGs/L
vxSvSdrCyw63iryvHrglJNMxCr2r+P6uxfSFwdNLxNRyk/2FRYIbex8/oTf1JP3u
Z4r8POUgDP5nTlOykA3Q+S6aLq4QG+wHn9+njcPmIHpOc/3+I25vaeRiPRH3G2Wq
jJiO3lqveLNKblUSAT56TAskThjsEqQBGB4gHQ29BuPrV01sUwZGwhnyZZdHbcJR
62QrAbTK/PVY+kW3NqR0BleAf/JlTAzpvOeEk5iVynTuRr9L1BmHA3vYVOs+fvio
gdPwvnmyJZu9UTmyKY20nCl2ycDLPpI8DK7j0l4NbzP0r/B3LVpnOZwqRRoF/oCz
9Hv9AXQsAI1Q6iOKN2G08eRuJZrONceif/yYIXz05BDnPABW9Ki7jE6y0f8lpMm0
vk0jA175ZmR/jMiHGpZFBlqFnpxmvqeQd5WfvjjSpudlzi7Qg1aH9x0TdJfpwAlL
Vxq+3zObrWb6Sui9GbLrWiAKMe+sBFThXvNhKkf6rmiQWdmKemITr4qfZP7SyunB
ssEqDy1LfN/BNcHQH7NXFPjPKe3nD1OKH6jK6ARoDpI5ZfIYx8IXurNFDAUefRtA
KUshD9vAGAA/f9UfMpNPeFyi+MCe1iKBJhS1MiHv8T3GdIiQKZ9sp6BcebiWjB0S
KD9gLXOmp8Fyn6U+X/K9ZwznhUp6wIDvO5nhe2P94SMb+MGo8M9KE4g3QXHBS74z
krOOU8QFl3PKGJcNopWf4sOTWy8EF2rh3ylJ7EDXxk7xbnRm6zkJDFeJzLUt7YK9
VI/0pNmGQ2uYhcmFg7MBPilH7Ni3w4oileOtw/meKIMNgOsf+Bhq9Io/xOHG3T6U
//kQ/XQZ1o1QzIJ6RIOt6mmgJx81WK6vuseGFxa2O2mw0CaiECxRwbHXG7Xnq3Sl
zFreUrBIK/Czj2mfYhfPIoS6i8AXBp1hKaO8RNUQoA+wjV75VtZOSPvF/Shtlvg0
wSxYMZNSrpUCQJilfoXW31HeJGZzlFNqujBjAy/9o4lj
-----END ENCRYPTED PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDNTCCAh2gAwIBAgIUQheIG4d2u6S9j7Kq5lxVm9+R2KcwDQYJKoZIhvcNAQEL
BQAwKDESMBAGA1UEAwwJbWl0bXByb3h5MRIwEAYDVQQKDAltaXRtcHJveHkwHhcN
MjMwMzI1MDAzNTQ0WhcNMjQwMzI2MDAzNTQ0WjAoMRIwEAYDVQQDDAltaXRtcHJv
eHkxEjAQBgNVBAoMCW1pdG1wcm94eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBALhLuhBxNx1S7yIbagJYnoDe8bMj6VMWS0HbIV7p46G5kQ2Hd3Ttt4bV
LuICyvJjFD185WMldnWgE86pqfwcpYCoIp97L1BRisDyzn5OBOF0/9FjPbzleFCL
0G7Yg0EnyR6Nzbqggp7Y3LPoABCFJH7/rXFizjFQAJ93gXX3H7R6jRN2oKIV1u07
5OHb2u2EIGEwH0IHVMXLe70PXkSaG3VompIAVPdiyOFi1alH/XgnNZ8f+VQAoOra
4es+AzZGzrWUoiQAUN9/jr+fEL8H0Ikl1b6M3H4aTwXUpCz6MXkLAUY484SLNyYV
DowMeY4wfsOFvT/b33/d4EYiVDGP/QsCAwEAAaNXMFUwDwYDVR0TAQH/BAUwAwEB
/zATBgNVHSUEDDAKBggrBgEFBQcDATAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
FGs+lgWgL2wN+lkgRkUQXFWR0iCWMA0GCSqGSIb3DQEBCwUAA4IBAQAbwGOWBxtc
U8did/TFaLbpW+AZuaTQvU/B+k3v0i8Dk5s+xTIbg+3TVMzZoB891LnHY2vY1M/9
+IA6IQ/870B0MHwDUnpGio0bs0tFvLssosyFxMVWe7o9miwWM87e8+qE0+nhWSMh
VkXs5dFq+58pkMM3B4hWRLzBEvIBXKBU8iJradtQLSugsOaTsXH8G+FFllXNk75W
I+gemyyQTwvixoUNTe0AW2lo4iBknYqz1mRRfckkPujWf/nZfbwwJBAz2SDgXHP6
LBgRQBTIvTNeFimDZ7ZD4MmOt2WpI5qUkTCqqgbfh9G5KQiYtyMcftvH45XULniJ
Fx0Pqrg698Vt
-----END CERTIFICATE-----

@mhils
Copy link
Member

mhils commented Mar 31, 2023

Thanks, very useful! The problem here is the order of operations: We first set condir, which triggers both loading config.yaml and loading $confdir/mitmproxy-ca.pem. The second operation then already crashes before we have a chance to include the passphrase from config.yaml.

wesolowski-gh added a commit to wesolowski-gh/mitmproxy that referenced this issue Apr 2, 2023
@wesolowski-gh
Load config files from proper dir. Fixes mitmproxy#6014
4729c91
wesolowski-gh added a commit to wesolowski-gh/mitmproxy that referenced this issue Apr 2, 2023
@wesolowski-gh
Load config files from proper dir. Fixes mitmproxy#6014
e82b04b
wesolowski-gh added a commit to wesolowski-gh/mitmproxy that referenced this issue Apr 2, 2023
@wesolowski-gh
Load config files before applying cmdargs options. Fixes mitmproxy#6014
3a886af
wesolowski-gh added a commit to wesolowski-gh/mitmproxy that referenced this issue Apr 2, 2023
@wesolowski-gh
Load config files before applying cmdargs options. Fixes mitmproxy#6014
3673ab7
@wesolowski-gh wesolowski-gh linked a pull request Apr 2, 2023 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/triage Unclassified issues
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Load config files before applying cmdargs options. Fixes #6014 wesolowski-gh/mitmproxy
3 participants
@Prinzhorn @mhils @Puliyo