Could anyone do tests against a proxy and SSL?

[chrjohn]

Hi,

is anyone able to conduct tests against a proxy? Preferrably with and without SSL enabled? In #441 I created a pull request which is compiled against MINA 2.2.x which overhauled the SSL support. To make it compile I needed to do some minor changes. But I cannot test against a proxy.

Is anyone of you guys able to help me out with that?

Thanks in advance!

[esanchezros]

Hi @chrjohn,

Maybe you can include integration tests that starts a mock proxy with and without SSL and run tests against it. I've used https://mock-server.com/proxy/running_mock_server_proxy.html which has lots of features that may be useful

[chrjohn]

Hi @esanchezros , thanks for the idea. I'll take a look.

[the-thing]

@chrjohn

I think SSL with proxy is currently broken. This is what is happening as far as I understand.

This is the filter chain used by MINA when using SSL + PROXY

HeadFilter
ExceptionHandler
ProxyFilter
SslFilter
ProtocolCodecFilter
TailFilter

ProxyFilter fails for the first time, because of missing proxy handler.

java.lang.IllegalStateException
at org.apache.mina.proxy.filter.ProxyFilter.getProxyHandler(ProxyFilter.java:124)
at org.apache.mina.proxy.filter.ProxyFilter.writeData(ProxyFilter.java:212)
at org.apache.mina.proxy.filter.ProxyFilter.filterWrite(ProxyFilter.java:198)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.callPreviousFilterWrite(DefaultIoFilterChain.java:753)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1500(DefaultIoFilterChain.java:49)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.filterWrite(DefaultIoFilterChain.java:1146)
at org.apache.mina.filter.ssl.SSLHandlerG0.write_handshake_loop(SSLHandlerG0.java:539)
at org.apache.mina.filter.ssl.SSLHandlerG0.write_handshake(SSLHandlerG0.java:470)
at org.apache.mina.filter.ssl.SSLHandlerG0.open(SSLHandlerG0.java:143)
at org.apache.mina.filter.ssl.SslFilter.onConnected(SslFilter.java:283)
at org.apache.mina.filter.ssl.SslFilter.onPostAdd(SslFilter.java:250)

Proxy handler is missing, because it is added during sessionCreated chain stage

org.apache.mina.core.filterchain.IoFilterAdapter#sessionCreated / org.apache.mina.proxy.filter.ProxyFilter#sessionCreated

SSLfilter chain executes onPostAdd -> onConnected -> and then tries to do proxy handshake which fails.

Surprisingly after that it tries to do the proxy handshake again and proxy server sees it (still no SSL which is good).

     	 +-------------------------------------------------+
     	 |  0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f |
+--------+-------------------------------------------------+----------------+
|00000000| 04 01 fa 69 7f 00 00 01 70 72 6f 78 79 2d 75 73 |...i....proxy-us|
|00000010| 65 72 00                                        |er.             |
+--------+-------------------------------------------------+----------------+

And responds with

CD = 90 / 5a (request granted)

         +-------------------------------------------------+
     	 |  0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f |
+--------+-------------------------------------------------+----------------+
|00000000| 00 5a 00 00 00 00 00 00                         |.Z......        |
+--------+-------------------------------------------------+----------------+

But proxy server response never arrives and is not processed by MINA.

[chrjohn]

Thank you. Sounds like apache/mina#41 (the part with postAdd() ) but don't know if that is everything that fails.

[the-thing]

Oh yeah thanks. Now I think I vaguely remember seeing it last year.

[chrjohn]

BTW do you think this is because of new MINA version?

[the-thing]

Yes, but it can be fixed at QuickFIX level with SSL filter override like the last time, before the official patch is released as suggested in the link (fix is applied on MINA 2.2.X, but not released yet). I will produce a quickfix patch soon. I also plan on adding integration tests (only SOCKS 4 & 5) via embedded Netty proxy, but let's see how it goes.

There are two useful things in Netty.

• SOCKS proxy server implementation we could use for tests (not sure if this can be adapted for HTTP proxy)
  https://github.com/netty/netty/blob/4.1/example/src/main/java/io/netty/example/socksproxy/SocksServer.java

• HTTP proxy server (I think this one is for mocking)
  https://github.com/netty/netty/blob/4.1/handler-proxy/src/test/java/io/netty/handler/proxy/HttpProxyServer.java

I tried this mock server proxy some time ago and I struggle to understand how it works. I assumed it could run as an embedded proxy server, but I can't manage to make it work. Maybe I was wrong or I just don;'t know how to use it properly.