Merge pull request #6 from ankane/newer_certs

Fix for no shared cipher error with newer versions of OpenSSL

cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDTCCAfWgAwIBAgIIStsK3QYI+tAwDQYJKoZIhvcNAQELBQAwIDEeMBwGA1UE
+AxMVbWluaWNhIHJvb3QgY2EgMDFmODVhMCAXDTE4MDcyNjA3Mzg0OFoYDzIxMDgw
+NzI2MDgzODQ4WjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQCYcRD4hKQnoflvSlMRWftfIb5N0fargSZyI1QgDrf0
+YknqYOF5UtEngoFDvtIuTZSl2bjsidZhJYebmNEmL6ULZE3UUXGwQGYBTCrjr8Ls
+Pdzjy9SlfBpm/xrhkATEqUQ8MnQ0EmJac6GvKFb2Ct3cYxMjHaCDbwMv5nDPDR85
+SsLYGkxgqcKmMaOw6ZRNpMhBKlHpRIhT+wcfXfcrP1fB212rCH424n1NPUtAYixN
+onKnv3Bz+FK5nqWVNaByC+6bonxsx1Y57zN9Wnc+DA2Bny6c7XgSHV2pUWqqnbmv
+Q+MZsrzOZuale2ie3fmlNESGyaNI1fhfwtqnfclQuvvZAgMBAAGjVTBTMA4GA1Ud
+DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0T
+AQH/BAIwADAUBgNVHREEDTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggEB
+AAdbvbNYIk0IvYE4oVdZwZye6bgj7rOUe+18Vz/EJbBjylkKmknraoyaMV3XP69B
+CT2qL5MbCjpFAFK5krX8s66Gkd2yJapyQa5vK52z5fKFPpehxfB3L43/BDmGadRD
+r992/Hj0mSrwmPhm3Koz++gnJ2AbmBxxy+SgISc69T2fJMccluZkHDKmpVLb9zeb
+oEy4YVVxZqILfVwsVXqO6QkIiy6I0fyWTRDylKINsXies8kWrrTtvyGTrR82DKEH
+yVVGdSA82Tc8VjZ6ZXq0BW8IgcVY/BLxbEc6pL93kb4swKIxXYrK8wDt1ug2Pi6F
+5ActJ26uig/FhICTKjh+51s=
+-----END CERTIFICATE-----

key.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAmHEQ+ISkJ6H5b0pTEVn7XyG+TdH2q4EmciNUIA639GJJ6mDh
+eVLRJ4KBQ77SLk2Updm47InWYSWHm5jRJi+lC2RN1FFxsEBmAUwq46/C7D3c48vU
+pXwaZv8a4ZAExKlEPDJ0NBJiWnOhryhW9grd3GMTIx2gg28DL+Zwzw0fOUrC2BpM
+YKnCpjGjsOmUTaTIQSpR6USIU/sHH133Kz9Xwdtdqwh+NuJ9TT1LQGIsTaJyp79w
+c/hSuZ6llTWgcgvum6J8bMdWOe8zfVp3PgwNgZ8unO14Eh1dqVFqqp25r0PjGbK8
+zmbmpXtont35pTREhsmjSNX4X8Lap33JULr72QIDAQABAoIBAEN4F3jGzBi2eb2l
++an+V2E9gArVWQWDPc7akAs4OHazYd+YTXLzEpsYCbpAJKpVr+rPuCcIwpdwktpt
+AnSSNcwa8s971IObnQoJ+hmX2v/QSYmQ12b+zHi1g+I9ab7Y49h4xDGfyWQbNX5e
+rk5rdNJsDzZFkJtbcN+scFVTi3RBUZ3zVxG1QUICkX/tfgNIY+FauMXrN6XVOmm1
++eoLgqrag9RdiCEYlQg3fqtz0s5c8GD0dyO0xD0Z8je9bs/Q/78ALVtd9/YeQeKi
+X9Ote/JiHXBB+CtzDSHem/w3t5615b6Qsbv9LtIBEGGmCg62Pd6atubBFlhg8+6K
+UWNEStkCgYEAwSaRDN62pvm5NIit3FbG4qyR8KUo960Lw27ZIZe33k6BpTWb3wKo
+nVi8MTS5W3A7zasfLlKREGj4/4lnf/ePjbLW34HLBCWlbS2S+TDbtSbTd/UqTVnO
+s+DLx3K2CHXOtpzTMNtAzF97BaUylJuDszFVBxS3vF3E8EeabGOP3UcCgYEAygtx
+zEBoHIuNSPRz3l4ARY3UUslA0EbL9Y48d2M42SdnN8n7ELckIIRuHlgak+CQFW2N
+kIT1cUlxkKM5Fxgvqz1q3KBTXb8DAnpRMBWUU6APTYB+MthDboTds8kt/+3Fsi0j
+L0X2MHNwAu1Tz3hKoAMtNtFkrALqenxtrlI+bd8CgYAG5j7GK+pwWnlAJCW5uivO
+iwWHiA7HkhnaeEovRgEeYsWExj50H98wB6xpQY3hc0ffl948RFzELku+rQTScGBj
+WmEMiNFcq4+WL8uRNSqT9PgWz94b9zpH+J6u2C0ibjrdEQsGMr7EziBR2k3NOyTg
+MMHtx9KsWtkfEB+3AXNxHwKBgFShBJKUa8eBILXtRtdesmhv5v6iM9bJwMbjRCqR
+0g8LdS2mGda/j49bSTDGoKNOTavcDo75UkGYjMwTwmcNB3KHsEonkaPTzXPtPjKQ
+52c7xQ0mhDXR5jTVzHNxEiaANu3SAEnd2SgkQkfHlvJxJXjuu7KZdLykIAkcM2jw
+JBwrAoGAGVYllJQ7OFNrrJP6rtbst7o0A95sqsrkMoP3hiDq9uVxX9qwgYn3j3Lp
+tmw8X3F8QJXb/3nwAaHRN3r43aRaaxfoDtMMzzKRLd2J5EUfQKMvXCl8DnvG91BC
+Z5G2RdKxmdbYSvKKUygWI1MJ7bMe34EtVqibjYvG4taxvb9lPzY=
+-----END RSA PRIVATE KEY-----

postgres_mitm.py

@@ -62,26 +62,6 @@ AUTH_METHODS = {
 
 AUTH_METHODS_REVERSE = {val: key for key, val in AUTH_METHODS.items()}
 
-CERTIFICATE = textwrap.dedent('''\
-    -----BEGIN CERTIFICATE-----
-    MIIBFTCBvQIJAOVlsttuSJP1MAoGCCqGSM49BAMCMBUxEzARBgNVBAMMCnNlbGZz
-    aWduZWQwHhcNMTYwNTI5MTg0NDAzWhcNMjYwNTI3MTg0NDAzWjAVMRMwEQYDVQQD
-    DApzZWxmc2lnbmVkMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAER28qhX8p79zv7x0G
-    Mkqef7KfDXgmobUfcUKhmt5Eqn+8GnraVjvrzAs+6jMcLemUj1+dLbkmFKMtFolA
-    f0EDbjAKBggqhkjOPQQDAgNHADBEAiAD1hIlVDGKtKkRyCZISZ/UteZ1hBzaX00Q
-    g6qnOtZlcgIgCWlME+pNLmaSeMVx7unb6zFGNhDzfxeSSJEM5tlCGZs=
-    -----END CERTIFICATE-----
-
-    -----BEGIN EC PARAMETERS-----
-    BgUrgQQACg==
-    -----END EC PARAMETERS-----
-    -----BEGIN EC PRIVATE KEY-----
-    MHMCAQEEHyXy23774hq9CTorIFwGuppBUlXIZN0eOsjruDkJopigBwYFK4EEAAqh
-    RANCAARHbyqFfynv3O/vHQYySp5/sp8NeCahtR9xQqGa3kSqf7waetpWO+vMCz7q
-    Mxwt6ZSPX50tuSYUoy0WiUB/QQNu
-    -----END EC PRIVATE KEY-----
-    ''')
-
 
 def main():
     args = get_args()
@@ -105,13 +85,9 @@ def main():
     last_check_for_stopped_threads = time.time()
 
     try:
-        cert_file = tempfile.NamedTemporaryFile(delete=False)
-        with cert_file:
-            cert_file.write(CERTIFICATE.encode('utf-8'))
         while True:
             client_socket, address = sock.accept()
-            client_handler = ClientConnection(client_socket, target_backend,
-                cert_file.name)
+            client_handler = ClientConnection(client_socket, target_backend)
             client_handler.start()
 
             threads.add(client_handler)
@@ -123,7 +99,6 @@ def main():
         sock.shutdown(socket.SHUT_RDWR)
         sock.close()
         stop_threads(threads)
-        os.remove(cert_file.name)
 
 
 def get_args():
@@ -157,14 +132,17 @@ def stop_threads(threads):
 
 class ClientConnection(threading.Thread):
 
-    def __init__(self, client_socket, target_backend, cert_file):
+    def __init__(self, client_socket, target_backend):
         super(ClientConnection, self).__init__()
         for proto in ('PROTOCOL_TLSv1_2', 'PROTOCOL_TLSv1', 'PROTOCOL_SSLv23'):
             protocol = getattr(ssl, proto, None)
             if protocol:
                 break
         self.ssl_context = ssl.SSLContext(protocol)
-        self.ssl_context.load_cert_chain(certfile=cert_file)
+        dirname = os.path.dirname(__file__)
+        cert = os.path.join(dirname, 'cert.pem')
+        key = os.path.join(dirname, 'key.pem')
+        self.ssl_context.load_cert_chain(cert, key)
         self.socket = client_socket
         self.target_backend = target_backend
         self.server_socket = None