Method cb_sni

scapy/fwdmachine.py:357–402

This callback occurs after the TLSClientHello is received by the server

(sock, server_name, _)

            _clisock = [ss]

            def cb_sni(sock, server_name, _):
                """
                This callback occurs after the TLSClientHello is received by the server
                """
                ss = _clisock[0]
                ctx.tls_sni_name = server_name  # the requested SNI
                # Use that SNI to wrap the client socket
                ss = clisslcontext.wrap_socket(ss, server_hostname=server_name)
                # Get certificate chain
                cas = ss._sslobj.get_unverified_chain()
                if self.crtfile is None:
                    # SELF-SIGNED mode
                    # Generate private key based on the type of certificate
                    privkey, certs = self.get_key_and_alike_chain(
                        cas, dest, server_name
                    )
                    # Load result certificate our SSL server
                    # (this is dumb but we need to store them on disk)
                    certfile = get_temp_file()
                    with open(certfile, "w") as fd:
                        for c in certs:
                            fd.write(c.pem)
                    keyfile = get_temp_file()
                    with open(keyfile, "wb") as fd:
                        password = os.urandom(32)
                        fd.write(
                            privkey.key.private_bytes(
                                encoding=serialization.Encoding.PEM,
                                format=serialization.PrivateFormat.PKCS8,
                                encryption_algorithm=serialization.BestAvailableEncryption(  # noqa: E501
                                    password
                                ),
                            )
                        )
                else:
                    # Certificate is provided
                    certfile = self.crtfile
                    keyfile = self.keyfile
                sslcontext = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
                sslcontext.check_hostname = False
                sslcontext.verify_mode = ssl.CERT_NONE  # note: server side
                sslcontext.load_cert_chain(certfile, keyfile, password=password)
                sock.context = sslcontext
                # Return success
                _clisock[0] = ss
                return None  # Continue

            # Server SSL context
            sslcontext = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)