@solids #5
仅考虑代理软件,代理软件会去向目标网站申请证书。而且没有校验证书是不是有效。
如果这个时候被GFW中间人攻击,代理软件会忽略,导致中间人攻击。
https://github.com/URenko/Accesser/ 官网写的 支持python3.7版本
https://docs.python.org/3/library/ssl.html
ssl.match_hostname 这段 Changed in version 3.7: The function is no longer used to TLS connections. Hostname matching is now performed by OpenSSL.
同时 Verifying certificates When calling the SSLContext constructor directly, CERT_NONE is the default. Since it does not authenticate the other peer, it can be insecure, especially in client mode where most of time you would like to ensure the authenticity of the server you’re talking to. Therefore, when in client mode, it is highly recommended to use CERT_REQUIRED. However, it is in itself not sufficient; you also have to check that the server certificate, which can be obtained by calling SSLSocket.getpeercert(), matches the desired service. For many protocols and applications, the service can be identified by the hostname; in this case, the match_hostname() function can be used. This common check is automatically performed when SSLContext.check_hostname is enabled.
Changed in version 3.7: Hostname matchings is now performed by OpenSSL. Python no longer uses match_hostname().
然后开始看代码201-204行
if self.host in setting.config['alert_hostname']:
server_hostname = setting.config['alert_hostname'][self.host]
else:
server_hostname = None
人话版本:如果代理软件认为域名 在 https://github.com/URenko/Accesser/blob/master/template/pac 文件的domains里的话,同时,域名不在https://github.com/URenko/Accesser/blob/master/config.json.default 的alert_hostname的话,则把SNI信息去除,否则改用 json里的域名
也就是说,代码是删除了SNI信息来完成规避SNI RST,这样GFW伪造一个证书,就可以骗过代理,因为代理不会检查证书