IRC log for #maemo on 20181029

00:00.28*** join/#maemo atk (~Arch-TK@2a01:7e00:e000:24e:109:74:205:187)
00:00.29*** join/#maemo atk (~Arch-TK@ircpuzzles/staff/Arch-TK)
02:18.49*** join/#maemo infobot (ibot@208.53.50.136)
02:18.49*** topic/#maemo is Welcome to #maemo http://maemo.org/intro/ | N9/harmattan related questions please in #harmattan ! | "firmware" see ~lf (or ~tabletsdev ~combined ~emmc ~flasher) sdk: ~sb | http://wiki.maemo.org/Community_Council | Source: http://wiki.maemo.org/Sources | Chanlog: http://mg.pov.lt/maemo-irclog | #maemo-ssu is where the (few) devels and maintainers of the maemo-future meet
02:18.49*** mode/#maemo [+v infobot] by ChanServ
03:21.09*** join/#maemo juiceme (~juice@cerebro.liukuma.net)
03:26.53*** join/#maemo tm (~sinnlos@unaffiliated/tm)
03:29.38*** join/#maemo BitEvil (~quassel@tor/regular/SpeedEvil)
03:45.19*** join/#maemo lukedashjr (~luke-jr@unaffiliated/luke-jr)
04:51.59*** join/#maemo pagurus` (~user@i577B7958.versanet.de)
04:55.29*** join/#maemo lukedashjr (~luke-jr@unaffiliated/luke-jr)
05:16.24MaxdamantusOkay, so luckily that certificate expired at Apr 24 14:09:34 2009.
05:17.02Maxdamantusbut if maemo has a clock set to a time before that, any SSL connection could be intercepted.
05:18.12MaxdamantusPresumably it's unused, unless there's something else in maemo that doesn't check the issuer expiry.
05:20.55MaxdamantusAh, actually, it's not used by microb. I guess it just tests the expiry time before checking that a certificate is in the store (since I was getting an "expired" error before setting my clock back)
06:18.06*** join/#maemo spiiroin (~spiiroin@2001:998:2a:deaf:fd66:53d0:a9d6:dca8)
07:06.37*** join/#maemo mavhc (~mavhc@cpc77319-basf12-2-0-cust433.12-3.cable.virginm.net)
07:07.46*** join/#maemo l_bratch (~l_bratch@serenity.bratch.co.uk)
07:20.34*** join/#maemo Venemo (~venemo@fedora/Venemo)
07:21.36*** join/#maemo dafox (~dafox@188.207.82.236)
07:56.44*** join/#maemo chfoo (~chfooZnc@nullhound.fart.website)
07:57.49*** join/#maemo hurrian (~hurrian@unaffiliated/rikanee)
08:03.23*** join/#maemo jskarvad (~jskarvad@redhat/jskarvad)
08:11.33*** join/#maemo florian_kc (~florian_k@Maemo/community/contributor/florian)
08:48.03*** join/#maemo hurrian (~hurrian@unaffiliated/rikanee)
09:18.59*** join/#maemo ceene (~ceene@salem.gmr.ssr.upm.es)
09:25.23*** join/#maemo florian_kc (~florian_k@Maemo/community/contributor/florian)
09:44.51*** join/#maemo Konsieur (~kabouik@65.76.93.92.rev.sfr.net)
09:48.16*** join/#maemo Kabouik (~kabouik@65.76.93.92.rev.sfr.net)
10:23.10MaxdamantusDamn, turns out Opera Mobile doesn't use SNI.
10:23.21MaxdamantusI thought I saw the host it was connecting to before.
10:24.29Maxdamantusmicrob uses it though.
10:24.58bencohSNI support sounds quite mandatory to me nowadays ...
10:25.10MaxdamantusAnyway, this is what I've made so far: https://gist.github.com/Maxdamantus/e32ab94dbc5d9d43298428400020620e
10:25.37bencohMaxdamantus: silly question, but why not use one of the already available small-footprint proxies?
10:25.45Maxdamantusbencoh: such as?
10:26.13bencohtinyproxy or polipo
10:26.24Maxdamantustinyproxy is an HTTP proxy
10:26.29MaxdamantusNothing to do with SSL
10:26.29bencoh(tinyproxy might not have proper support for ssl, I don't quite remember)
10:26.33Maxdamantuslooks at polipo
10:26.50MaxdamantusAgain sounds like an HTTP proxy.
10:26.56bencohTinyproxy is a light-weight HTTP/HTTPS proxy daemon
10:27.06MaxdamantusThat's a fairly misleading description.
10:27.18KotCzarnyyou can have https proxy without any ssl
10:27.23KotCzarnyjust copy data as is
10:27.28KotCzarnyi do it in my own proxy
10:27.49KotCzarnyyou need a proxy that does ssl management if you want to interact in any way
10:28.03Wizzupa thread for every socket?
10:28.03MaxdamantusYes, that's the intention of my program above.
10:28.19MaxdamantusWizzup: for now, yes.
10:28.33Wizzupwell, looks lke you're having fun :)
10:28.34MaxdamantusI don't expect to be maintaining a large number of connections.
10:28.35bencohyou might be right about tinyproxy
10:28.56WizzupI'd personally do it in go - since it links statically with the latest tls support and does all of this multiplexing easily, but I guess there's no point to suggesting it :P
10:29.01Maxdamantusalso note that the program above is agnostic about a particular protocol.
10:29.06Wizzupsure, just tls + sni
10:29.12bencohpolipo caches content, so it probably handles ssl properly, though
10:29.26bencohMaxdamantus: you can't really be protocol-agnostic when it comes to starttls
10:29.36bencohand you'll eventually have to handle that as well
10:30.03bencoh(same goes for SNI, actually)
10:30.05Maxdamantusbencoh: well, it assumes that the entire socket is encapsulated in TLS.
10:30.15Maxdamantusotherwise it's protocol agnostic.
10:30.24Maxdamantus(though atm it doesn't forward ALPN)
10:31.22Maxdamantusalso regarding proxying, opera mobile doesn't seem to have the option to use a proxy.
10:31.42Maxdamantusand I'm guessing if microb/firefox has that option, it will still want to use SSL over the proxy.
10:31.46Wizzupwhat if you set the env variables?
10:32.00KotCzarnyin the worst case you have iptables
10:32.00Maxdamantus(ie, it'd rely on something like `CONNECT google.com:443`)
10:32.05WizzupMaxdamantus: yes, indeed, it will do it's own tls over the proxy.
10:32.34MaxdamantusWizzup: right, in which case polipo won't help, unless polipo actually does the funky TLS stuff that my program does.
10:32.37WizzupMaxdamantus: but you can intercept it
10:32.42Wizzupyes
10:32.53Maxdamantus(funky stuff = generating/signing certificates on the fly)
10:33.06Wizzupwhy do you need to do that, though?
10:33.44Wizzupif you have your own CA, you can just install a wildcard cert, no?
10:33.49MaxdamantusBecause if the browser makes a request to "google.com", the certificate used needs to have CN=google.com
10:33.53Wizzup(plus, generating keys + certs takes a -long- time)
10:33.59WizzupMaxdamantus: wildcard should work?
10:34.05MaxdamantusTLD wildcards are illegal.
10:34.13Wizzuphow do you think mitm proxies work?
10:34.15Maxdamantusie, *.com and * are illegal.
10:34.21MaxdamantusWizzup: they have to do what I do.
10:34.23Wizzupreally?
10:34.25Wizzupmhm
10:34.29MaxdamantusWizzup: that's almost certainly what "mitmproxy" does.
10:34.30Wizzupwell, I guess you can re-use the same key
10:34.34Wizzupthen it doesn't take long
10:34.51Maxdamantus(mitmproxy being some debugging utility written in Python, seems unsuitable for running locally on N900)
10:34.57MaxdamantusYes, I use the same key.
10:35.03Maxdamantusbut have to generate different certificates.
10:35.16Wizzupmaybe I'll do it in go for fun some time
10:36.50MaxdamantusThe "CAKEY.pem" passed in to my program is meant to be the key for the CA certificate, and it also uses that same key for all generated certificates.
10:37.10MaxdamantusIt could theoretically take in a second key for the latter, but that seems unnecessary.
10:37.41KotCzarnygenerating certs is not a big problem if you just need it for few frequent sites
10:37.54Wizzupyou could use transparent socks proxy if n900 supports it
10:37.57Wizzup(with iptables)
10:37.58Maxdamantusand when/if I get it working properly, I'd rather just keep the key in memory instead of storing it on the filesystem, so don't want to generate too many keys on boot.
10:38.18WizzupMaxdamantus: just generate a new intermediate?
10:38.27MaxdamantusWizzup: there's no intermediate.
10:38.38Wizzupthen generate one ;)
10:38.44MaxdamantusHow does an intermediate help?
10:38.55Wizzupif you want to keep the keys in memory...
10:39.01Wizzupeh, whatever :)
10:39.09MaxdamantusThe intermediate would need to be signed by the trusted certificate's key.
10:39.37siceloopera mobile *can* use a proxy. it's in about:opera, or some such
10:40.18siceloopera:config
10:40.45MaxdamantusOh, cool.
10:41.03MaxdamantusOkay, guess I'll adapt it to use that tomorrow.
10:41.20MaxdamantusThat should solve the lacking SNI issue too.
10:41.28Maxdamantussince whatever it sends to the proxy should have the hostname.
10:44.05Maxdamantusand yeah, that treats the proxy as an HTTP proxy and just uses "CONNECT github.com:443 HTTP/1.1                                                                                                                                                      
10:44.09Maxdamantus"
10:44.12Maxdamantuseh, spaces.
10:46.11*** join/#maemo jskarvad (~jskarvad@redhat/jskarvad)
10:47.57bencohhmm, mitmproxy looks pretty handy for android app REing
10:53.00Maxdamantusalso simplifies getting the browser to actually connect to the proxy.
10:54.02Maxdamantuswas intending on adding netfilter rules that did something like forward all :443 traffic to the proxy, unless the source is some particular address, which the proxy would bind to for outgoing connections.
10:58.17Maxdamantusbtw, https://github.com/kr/mitm might already be a sufficient Go implementation.
11:01.44MaxdamantusHave to be careful with all these things though, given how explicit you have to be in OpenSSL to actually get validation to work.
11:03.10Maxdamantuseg, checking that the certificate is valid and checking that the CN in the certificate matches what you're connecting to are different things.
11:05.14Maxdamantuseven though the hostname is specified in two places already (`BIO_set_conn_hostname` (for DNS lookup) and `SSL_set_tlsextl_host_name` (SNI))
11:10.13*** join/#maemo eMHa (~mh@81.26.162.98)
11:24.11*** join/#maemo mavhc (~mavhc@cpc77319-basf12-2-0-cust433.12-3.cable.virginm.net)
11:42.40*** join/#maemo Venemo (~venemo@fedora/Venemo)
12:11.34*** join/#maemo troulouliou_div2 (~troulouli@unaffiliated/troulouliou-div2/x-0271439)
13:45.45*** join/#maemo ceene (~ceene@salem.gmr.ssr.upm.es)
13:52.40*** join/#maemo spiiroin (~spiiroin@213-216-236-184.bb.dnainternet.fi)
13:56.30*** join/#maemo keithzg_ (~keithzg@198-48-134-113.cpe.pppoe.ca)
14:59.23DocScrutinizer05BYEBYE Merkel
14:59.52DocScrutinizer05hurry up a bit! don't forget to take you rocks with you
15:00.20KotCzarnydont worry, refugees are there to stay
15:01.05DocScrutinizer05I don't care too much about any refugees
15:01.55KotCzarnywell, not refugees, hostile tools of national identity disintegration
15:10.24KotCzarnyalso, 2021? is that a joke?
15:13.42KotCzarny2 more years of the fun
15:29.06DocScrutinizer05alas you got a few points there
15:30.10DocScrutinizer05is tempted to run the streets shouting "HURRY UP! GET LOST!"
15:30.42DocScrutinizer05"I WONT SURVIVE ANOTHER 2 YEARS OF THAT NARCOTIC"
15:34.56DocScrutinizer05there's hope she can't pull off the chancellorship 2 years as lame duck
16:38.27*** join/#maemo rysiek|pl (~quassel@static.51.54.9.176.clients.your-server.de)
16:43.08*** join/#maemo dafox (~dafox@188.206.73.61)
17:38.45*** join/#maemo Pali (~pali@Maemo/community/contributor/Pali)
17:39.28*** join/#maemo dafox (~dafox@188.206.73.61)
17:58.05*** join/#maemo ced117 (~ced117@ghost.ced117.net)
17:58.05*** join/#maemo ced117 (~ced117@opensuse/member/ced117)
18:17.32*** join/#maemo eMHa (~mh@p5089DF5B.dip0.t-ipconnect.de)
18:40.31*** join/#maemo florian_kc (~florian_k@Maemo/community/contributor/florian)
18:41.43*** join/#maemo florian_kc (~florian_k@Maemo/community/contributor/florian)
19:48.25*** join/#maemo halftux (~halftux@mue-88-130-99-009.dsl.tropolys.de)
19:51.27halftuxdoes somebody know where I could find these automated generated maemo diff files to debian source packages?
19:52.07sicelowhich ones?
19:55.44*** join/#maemo florian (~florian_k@Maemo/community/contributor/florian)
19:55.52halftuxlibsoup2.4
19:56.16halftuxfrom original maemo source
19:57.21halftuxthere was an url were you could generate diff files from debian to maemo but I forget
20:12.23sicelono idea. :-/
21:07.32*** join/#maemo Kabouik (~kabouik@65.76.93.92.rev.sfr.net)
21:48.16*** join/#maemo M4rtinK (~M4rtinK@ip-89-102-28-233.net.upcbroadband.cz)
21:56.21*** join/#maemo Venemo (~venemo@fedora/Venemo)
22:11.43*** join/#maemo Kabouik (~kabouik@65.76.93.92.rev.sfr.net)
22:16.01DocScrutinizer05halftux, sicelo: it's dead since ages

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.