Method handler

scapy/fwdmachine.py:334–499

Handler of a client socket

(self, sock, addr, dest)

        return privkey, certs

    def handler(self, sock, addr, dest):
        """
        Handler of a client socket
        """
        ctx = self.CONTEXT(addr, dest)  # we have a context object
        # Initialize peer socket
        ss = self._getpeersock(dest)
        # Wrap both server and peer sockets in SSL
        if self.tls:
            # Build client SSL context
            clisslcontext = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
            clisslcontext.load_default_certs()
            clisslcontext.check_hostname = False
            clisslcontext.verify_mode = ssl.CERT_NONE

            # This acts as follows:
            # - start the server-side TLS handshake
            # - use the SNI callback to pop a client-side socket (using the real
            #   provided SNI)
            # - serve the certificate

            _clisock = [ss]

            def cb_sni(sock, server_name, _):
                """
                This callback occurs after the TLSClientHello is received by the server
                """
                ss = _clisock[0]
                ctx.tls_sni_name = server_name  # the requested SNI
                # Use that SNI to wrap the client socket
                ss = clisslcontext.wrap_socket(ss, server_hostname=server_name)
                # Get certificate chain
                cas = ss._sslobj.get_unverified_chain()
                if self.crtfile is None:
                    # SELF-SIGNED mode
                    # Generate private key based on the type of certificate
                    privkey, certs = self.get_key_and_alike_chain(
                        cas, dest, server_name
                    )
                    # Load result certificate our SSL server
                    # (this is dumb but we need to store them on disk)
                    certfile = get_temp_file()
                    with open(certfile, "w") as fd:
                        for c in certs:
                            fd.write(c.pem)
                    keyfile = get_temp_file()
                    with open(keyfile, "wb") as fd:
                        password = os.urandom(32)
                        fd.write(
                            privkey.key.private_bytes(
                                encoding=serialization.Encoding.PEM,
                                format=serialization.PrivateFormat.PKCS8,
                                encryption_algorithm=serialization.BestAvailableEncryption(  # noqa: E501
                                    password
                                ),
                            )
                        )
                else: