Search code examples
socketshttpsopensslnetwork-programminghttp-proxy

Query regarding SSL_connect and HTTPS


I wanted send an HTTPS request through a proxy server and obtain the HTML of the landing page of the site. The socket creation went smoothly but when i wanted to make an SSL connection to the server it gave me a "Aborted (Core Dumped)" error. I've narrowed the cause down to the SSL_connect function. When i tried to do the same without the proxy server (using struct addrinfo instead of struct sockaddr since I needed to make a DNS query to get the IP), it worked perfectly and I was able to get a valid HTTP response along with the HTML. Can someone help me out ?

        SSL_library_init();
        SSL_load_error_strings();
        ssl_ctx = SSL_CTX_new(SSLv23_client_method ());

        int sockfd2 = socket(AF_INET,SOCK_STREAM,0);
        struct sockaddr_in httpsProxy; 
    
        httpsProxy.sin_family = AF_INET;
        httpsProxy.sin_addr.s_addr = inet_addr("<insert IP>");
        httpsProxy.sin_port = htons(13128);
        connect(sockfd2,(struct sockaddr *)&httpsProxy,sizeof(httpsProxy));
    
        SSL *conn = SSL_new(ssl_ctx);
        SSL_set_fd(conn, sockfd2);
        int err = SSL_connect(conn);

Solution

  • You need to connect to the proxy and request it to connect to the target HTTPS server, without using SSL/TLS yet while communicating with the proxy, and only if successful THEN perform the SSL/TLS handshake via SSL_connect() once you are communicating with the HTTPS server, not with the proxy anymore.

    SSL_library_init();
    SSL_load_error_strings();
    
    int sockfd = socket(AF_INET, SOCK_STREAM, 0);
    
    struct sockaddr_in httpsProxy = {};
    httpsProxy.sin_family = AF_INET;
    httpsProxy.sin_addr.s_addr = inet_addr("<proxy IP>");
    httpsProxy.sin_port = htons(13128);
    
    // connect to proxy...
    if (connect(sockfd, (struct sockaddr *)&httpsProxy, sizeof(httpsProxy)) < 0)
    {
        ...
        close(sockfd);
        return;
    }
    
    // ask proxy to connect to target HTTPS server...
    if (!<connect proxy to HTTPS server>)
    {
        ...
        close(sockfd);
        return;
    }
    
    // NOW start SSL/TLS with HTTPS server...
    ssl_ctx = SSL_CTX_new(SSLv23_client_method ());
    SSL *conn = SSL_new(ssl_ctx);
    SSL_set_fd(conn, sockfd);
    int err = SSL_connect(conn);
    ...