RubyGems - evil-proxy - Versions diffs - 0.0.2 → 0.0.3 - Mend

evil-proxy 0.0.2 → 0.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

checksums.yaml +4 -4
data/.gitignore +1 -0
data/README.md +40 -1
data/bin/evil-proxy +8 -0
data/evil-proxy.gemspec +3 -2
data/lib/evil-proxy.rb +1 -0
data/lib/evil-proxy/agentproxy.rb +54 -0
data/lib/evil-proxy/httpproxy.rb +7 -5
data/lib/evil-proxy/httprequest.rb +3 -9
data/lib/evil-proxy/mitmproxy.rb +116 -0
data/lib/evil-proxy/quickcert.rb +349 -0
data/lib/evil-proxy/version.rb +1 -1
metadata +24 -5

checksums.yaml CHANGED

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f4c501bef2b64e58b8393c8cc73a6516739f8b87
-  data.tar.gz: 9f8c54251a54e7f68cb47b04363ea746ed0956e1
+  metadata.gz: 53684305896f9e807ca7a800ce16365d1075047b
+  data.tar.gz: 9f3436b932cd284a97d572630b8eef0c82f8ccba
 SHA512:
-  metadata.gz: dc6113ee6f3043cc8ddd8e70dc4423dc717281c5eb589cbc878531fa2019b280b09d1fbb8c9ae789d7b2c1ce8d93d4ad44f061a7c6ff8b67506838c44dc85b4c
-  data.tar.gz: c598d95d33cdbaf4ec131697f3b95015f39f5a31dda3fe8043522d912d9ed9bbf0a0ad903fa51e251def4f3f7829facaa4af45aa4bc20f5873028408312cc8e1
+  metadata.gz: f4ab48b584aedfb81bdd292a29764fbcd17a2b55f91ad648ef1c07f572ccc5a8552bcea270a088c5766dc806bbf6f1243b6d77e0c34e4e9ed9fcc70503ff15f8
+  data.tar.gz: 6f4f16d5c257a680e7e13a6b8090ffa2bc561f324e75e7b29d302ee36f5dcd146ba761333942066042ffdd6af54900b2e34f2e30da7cfe4ead31d7fa9f3852fa

data/.gitignore CHANGED

@@ -10,6 +10,7 @@ coverage
 doc/
 lib/bundler/man
 pkg
+certs
 rdoc
 spec/reports
 test/tmp

data/README.md CHANGED

@@ -1,6 +1,6 @@
 # EvilProxy
-A ruby http proxy to do :imp: things.
+A ruby http/https proxy, with SSL MITM support to do :imp: things.
 ## Installation
@@ -18,6 +18,45 @@ Or install it yourself as:
 ## Usage
+#### MITMProxyServer
+`MITMProxyServer` is a subclass of `HTTPProxyServer`, so it also has the callback & plugin system, this proxy will embed a mini CA, which generates certificates on the fly, so you may need to import the CA certificate (./certs/CA/cacert.pem) into your browser.
+```ruby
+require 'evil-proxy'
+proxy = EvilProxy::MITMProxyServer.new Port: 8080
+proxy.start
+```
+Without import the CA certificate
+```shell
+$ https_proxy=http://localhost:8080 curl https://github.com
+# =>
+# curl: (60) SSL certificate problem: Invalid certificate chain
+# More details here: http://curl.haxx.se/docs/sslcerts.html
+#
+# curl performs SSL certificate verification by default, using a "bundle"
+#  of Certificate Authority (CA) public keys (CA certs). If the default
+#  bundle file isn't adequate, you can specify an alternate file
+#  using the --cacert option.
+# If this HTTPS server uses a certificate signed by a CA represented in
+#  the bundle, the certificate verification probably failed due to a
+#  problem with the certificate (it might be expired, or the name might
+#  not match the domain name in the URL).
+# If you'd like to turn off curl's verification of the certificate, use
+#  the -k (or --insecure) option.
+```
+```shell
+$ https_proxy=http://localhost:8080 curl https://github.com --insecure
+# =>
+# <!DOCTYPE html>
+# <html lang="en" class="">
+# ...
+```
+So you can intercept and modify https traffic, ie: requests & responses.
 #### Basic usage: hooks
 ```ruby

data/bin/evil-proxy ADDED

@@ -0,0 +1,8 @@
+#!/usr/bin/env ruby
+require 'evil-proxy'
+logger = WEBrick::Log.new(nil, 5)
+proxy = EvilProxy::MITMProxyServer.new Port: 8080, Logger: logger
+proxy.start

data/evil-proxy.gemspec CHANGED

@@ -8,8 +8,8 @@ Gem::Specification.new do |spec|
   spec.version       = EvilProxy::VERSION
   spec.authors       = ["Theo"]
   spec.email         = ["bbtfrr@gmail.com"]
-  spec.summary       = %q{A ruby http proxy to do EVIL things.}
-  spec.description   = %q{A ruby http proxy to do EVIL things.}
+  spec.summary       = %q{A ruby http/https proxy to do EVIL things.}
+  spec.description   = %q{A ruby http/https proxy, with SSL MITM support.}
   spec.homepage      = "https://github.com/bbtfr/evil-proxy"
   spec.license       = "MIT"
@@ -20,4 +20,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "bundler", "~> 1.6"
   spec.add_development_dependency "rake"
+  spec.add_development_dependency "pry-byebug"
 end

data/lib/evil-proxy.rb CHANGED

@@ -1,5 +1,6 @@
 require "evil-proxy/version"
 require "evil-proxy/httpproxy"
+require "evil-proxy/mitmproxy"
 require "evil-proxy/httprequest"
 module EvilProxy

data/lib/evil-proxy/agentproxy.rb ADDED

@@ -0,0 +1,54 @@
+require 'webrick'
+require 'webrick/https'
+require 'webrick/httpproxy'
+require 'openssl'
+require 'pry-byebug'
+class EvilProxy::AgentProxyServer < EvilProxy::HTTPProxyServer
+  def initialize_callbacks config
+    @mitm_server = config[:MITMProxyServer]
+  end
+  def fire key, *args
+    @mitm_server.fire key, *args, self
+  end
+  def perform_proxy_request(req, res)
+    uri = req.request_uri
+    path = uri.path.dup
+    path << "?" << uri.query if uri.query
+    header = Hash.new
+    choose_header(req, header)
+    response = nil
+    http = Net::HTTP.new(uri.host, uri.port)
+    http.use_ssl = true
+    http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    http.start do
+      if @config[:ProxyTimeout]
+        ##################################   these issues are
+        http.open_timeout = 30   # secs  #   necessary (maybe because
+        http.read_timeout = 60   # secs  #   Ruby's bug, but why?)
+        ##################################
+      end
+      response = yield(http, path, header)
+    end
+    # Persistent connection requirements are mysterious for me.
+    # So I will close the connection in every response.
+    res['proxy-connection'] = "close"
+    res['connection'] = "close"
+    # Convert Net::HTTP::HTTPResponse to WEBrick::HTTPResponse
+    res.status = response.code.to_i
+    choose_header(response, res)
+    set_cookie(response, res)
+    res.body = response.body
+  end
+  alias_method :service, :proxy_service
+end

data/lib/evil-proxy/httpproxy.rb CHANGED

@@ -2,12 +2,14 @@ require 'webrick'
 require 'webrick/httpproxy'
 class EvilProxy::HTTPProxyServer < WEBrick::HTTPProxyServer
+  attr_reader :callbacks
   VALID_CALBACKS = Array.new
   DEFAULT_CALLBACKS = Hash.new
-  def initialize *args
-    initialize_callbacks
-    fire :when_initialize, *args
+  def initialize config = {}, default = WEBrick::Config::HTTP
+    initialize_callbacks config
+    fire :when_initialize, config, default
     super
   end
@@ -27,7 +29,7 @@ class EvilProxy::HTTPProxyServer < WEBrick::HTTPProxyServer
     end
   end
-  def proxy_service req, res
+  def service req, res
     fire :before_request, req
     super
     fire :before_response, req, res
@@ -64,7 +66,7 @@ class EvilProxy::HTTPProxyServer < WEBrick::HTTPProxyServer
   end
 private
-  def initialize_callbacks
+  def initialize_callbacks config
     @callbacks = Hash.new
     DEFAULT_CALLBACKS.each do |key, callbacks|
       @callbacks[key] = callbacks.clone

data/lib/evil-proxy/httprequest.rb CHANGED

@@ -1,11 +1,5 @@
-WEBrick::HTTPRequest.class_eval do
-  alias_method :original_body, :body
-  def body
-    @evil_body || original_body
-  end
-  def body= body
-    @evil_body = body
-  end
+require 'webrick/httprequest'
+WEBrick::HTTPRequest.class_eval do
+  attr_writer :body, :unparsed_uri
 end

data/lib/evil-proxy/mitmproxy.rb ADDED

@@ -0,0 +1,116 @@
+require 'evil-proxy/httpproxy'
+require 'evil-proxy/agentproxy'
+require 'evil-proxy/quickcert'
+class EvilProxy::MITMProxyServer < EvilProxy::HTTPProxyServer
+  def initialize config
+    super
+    @mitm_servers = {}
+    @mitm_port = 4433
+  end
+  def ca
+    return @ca if @ca
+    logger.info "Create CA"
+    ca_config = {}
+    ca_config[:hostname] = 'ca'
+    ca_config[:domainname] = 'mitm.proxy'
+    ca_config[:password] = 'password'
+    ca_config[:CA_dir] ||= File.join(Dir.pwd, "certs/CA")
+    ca_config[:keypair_file] ||= File.join ca_config[:CA_dir], "private/cakeypair.pem"
+    ca_config[:cert_file] ||= File.join ca_config[:CA_dir], "cacert.pem"
+    ca_config[:serial_file] ||= File.join ca_config[:CA_dir], "serial"
+    ca_config[:new_certs_dir] ||= File.join ca_config[:CA_dir], "newcerts"
+    ca_config[:new_keypair_dir] ||= File.join ca_config[:CA_dir], "private/keypair_backup"
+    ca_config[:crl_dir] ||= File.join ca_config[:CA_dir], "crl"
+    ca_config[:ca_cert_days] ||= 5 * 365 # five years
+    ca_config[:ca_rsa_key_length] ||= 2048
+    ca_config[:cert_days] ||= 365 # one year
+    ca_config[:cert_key_length_min] ||= 1024
+    ca_config[:cert_key_length_max] ||= 2048
+    ca_config[:crl_file] ||= File.join ca_config[:crl_dir], "#{ca_config[:hostname]}.crl"
+    ca_config[:crl_pem_file] ||= File.join ca_config[:crl_dir], "#{ca_config[:hostname]}.pem"
+    ca_config[:crl_days] ||= 14
+    if ca_config[:name].nil?
+      ca_config[:name] = [
+        ['C', 'US', OpenSSL::ASN1::PRINTABLESTRING],
+        ['O', ca_config[:domainname], OpenSSL::ASN1::UTF8STRING],
+        ['OU', ca_config[:hostname], OpenSSL::ASN1::UTF8STRING],
+      ]
+    end
+    @ca = QuickCert.new ca_config
+  end
+  def create_self_signed_cert host
+    cn = [["C", "US"], ["O", host], ["CN", host]]
+    comment = "Generated by Ruby/OpenSSL/MITMProxyServer"
+    name = OpenSSL::X509::Name.new(cn)
+    hostname = name.to_s.scan(/CN=([\w.]+)/)[0][0]
+    logger.info "Create cert for #{hostname}"
+    cert_config = { type: 'server', hostname: hostname }
+    cert_file, cert, key = ca.create_cert(cert_config)
+    return cert, key
+  end
+  def retry_start_agent_server config
+    mitm_server = nil
+    10.times do
+      begin
+        # XXX: ask system for an unused port
+        config = config.merge(Port: @mitm_port)
+        mitm_server = EvilProxy::AgentProxyServer.new config
+      rescue Errno::EADDRINUSE
+      ensure
+        @mitm_port += 1
+        return mitm_server if mitm_server
+      end
+    end
+    raise RuntimeError, "No avaliable port found, stop retrying"
+  end
+  def start_mitm_server unparsed_uri, host, port
+    if @mitm_servers[unparsed_uri]
+      return @mitm_servers[unparsed_uri].config[:Port]
+    else
+      cert, key = create_self_signed_cert host
+      agent_config = self.config.merge(
+        MITMProxyServer: self,
+        SSLEnable: true,
+        SSLVerifyClient: OpenSSL::SSL::VERIFY_NONE,
+        SSLCertificate: cert,
+        SSLPrivateKey: key,
+      )
+      mitm_server = retry_start_agent_server agent_config
+      @mitm_servers[unparsed_uri] = mitm_server
+      Thread.new do mitm_server.start end
+      return mitm_server.config[:Port]
+    end
+  end
+  def do_MITM req, res
+    unparsed_uri = req.unparsed_uri
+    host, port = unparsed_uri.split(":")
+    port ||= 443
+    mitm_port = start_mitm_server unparsed_uri, host, port
+    req.unparsed_uri = "127.0.0.1:#{mitm_port}"
+  end
+  def do_CONNECT req, res
+    do_MITM req, res
+    super
+  end
+end

data/lib/evil-proxy/quickcert.rb ADDED

@@ -0,0 +1,349 @@
+require 'openssl'
+# QuickCert from http://segment7.net/projects/ruby/QuickCert/
+# QuickCert allows you to quickly and easily create SSL
+# certificates.  It uses a simple configuration file to generate
+# self-signed client and server certificates.
+#
+# QuickCert is a compilation of NAKAMURA Hiroshi's post to
+# ruby-talk number 89917:
+#
+# http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/89917
+#
+# the example scripts referenced in the above post, and
+# gen_csr.rb from Ruby's OpenSSL examples.
+#
+# A simple QuickCert configuration file looks like:
+#
+#   full_hostname = `hostname`.strip
+#   domainname = full_hostname.split('.')[1..-1].join('.')
+#   hostname = full_hostname.split('.')[0]
+#
+#   CA[:hostname] = hostname
+#   CA[:domainname] = domainname
+#   CA[:CA_dir] = File.join Dir.pwd, "CA"
+#   CA[:password] = '1234'
+#
+#   CERTS << {
+#     :type => 'server',
+#     :hostname => 'uriel',
+#     :password => '5678',
+#   }
+#
+#   CERTS << {
+#     :type => 'client',
+#     :user => 'drbrain',
+#     :email => 'drbrain@segment7.net',
+#   }
+#
+# This configuration will create a Certificate Authority in a
+# 'CA' directory in the current directory, a server certificate
+# with password '5678' for the server 'uriel' in a directory
+# named 'uriel', and a client certificate for drbrain in the
+# directory 'drbrain' with no password.
+#
+# There are additional SSL knobs you can tweak in the
+# qc_defaults.rb file.
+#
+# To generate the certificates, simply create a qc_config file
+# where you want the certificate directories to be created, then
+# run QuickCert.
+#
+# QuickCert's homepage is:
+# http://segment7.net/projects/ruby/QuickCert/
+class QuickCert
+  ##
+  # QuickCert Version
+  VERSION = "1.0.2"
+  CERT_DIR = File.join(Dir.pwd, "certs")
+  Dir.mkdir(CERT_DIR) unless File.exists?(CERT_DIR)
+  ##
+  # Creates a new QuickCert instance using the Certificate
+  # Authority described in +ca_config+.  If there is no CA at
+  # ca_config[:CA_dir], then QuickCert will initialize a new one.
+  def initialize(ca_config)
+    @ca_config = ca_config
+    create_ca
+  end
+  ##
+  # Creates a new certificate from +cert_config+ that is signed
+  # by the CA.
+  def create_cert(cert_config)
+    dest = cert_config[:hostname] || cert_config[:user]
+    key_file = "#{CERT_DIR}/#{dest}/#{dest}_keypair.pem"
+    cert_file = "#{CERT_DIR}/#{dest}/cert_#{dest}.pem"
+    if File.exists?(cert_file) && File.exists?(key_file)
+      key = OpenSSL::PKey::RSA.new(File.read(key_file))
+      cert = OpenSSL::X509::Certificate.new(File.read(cert_file))
+    else
+      cert_keypair, key = create_key(cert_config)
+      cert_csr = create_csr(cert_config, cert_keypair)
+      cert_file, cert = sign_cert(cert_config, cert_keypair, cert_csr)
+    end
+    return cert_file, cert, key
+  end
+  ##
+  # Creates a new Certificate Authority from @ca_config if it
+  # does not already exist at ca_config[:CA_dir].
+  def create_ca
+    return if File.exists? @ca_config[:CA_dir]
+    Dir.mkdir @ca_config[:CA_dir]
+    Dir.mkdir File.join(@ca_config[:CA_dir], 'private'), 0700
+    Dir.mkdir File.join(@ca_config[:CA_dir], 'newcerts')
+    Dir.mkdir File.join(@ca_config[:CA_dir], 'crl')
+    File.open @ca_config[:serial_file], 'w' do |f| f << "#{Time.now.to_i}" end
+    puts "Generating CA keypair" if $DEBUG
+    keypair = OpenSSL::PKey::RSA.new @ca_config[:ca_rsa_key_length]
+    cert = OpenSSL::X509::Certificate.new
+    name = @ca_config[:name].dup << ['CN', 'CA']
+    cert.subject = cert.issuer = OpenSSL::X509::Name.new(name)
+    cert.not_before = Time.now
+    cert.not_after = Time.now + @ca_config[:ca_cert_days] * 24 * 60 * 60
+    cert.public_key = keypair.public_key
+    cert.serial = 0x0
+    cert.version = 2 # X509v3
+    ef = OpenSSL::X509::ExtensionFactory.new
+    ef.subject_certificate = cert
+    ef.issuer_certificate = cert
+    cert.extensions = [
+      ef.create_extension("basicConstraints","CA:TRUE", true),
+      ef.create_extension("nsComment","Ruby/OpenSSL Generated Certificate"),
+      ef.create_extension("subjectKeyIdentifier", "hash"),
+      ef.create_extension("keyUsage", "cRLSign,keyCertSign", true),
+    ]
+    cert.add_extension ef.create_extension("authorityKeyIdentifier",
+                                           "keyid:always,issuer:always")
+    cert.sign(keypair, OpenSSL::Digest::SHA1.new)
+    keypair_export = keypair.export(OpenSSL::Cipher::DES.new(:EDE3, :CBC), @ca_config[:password])
+    puts "Writing keypair to #{@ca_config[:keypair_file]}" if $DEBUG
+    File.open @ca_config[:keypair_file], "w", 0400 do |fp|
+      fp << keypair_export
+    end
+    puts "Writing cert to #{@ca_config[:cert_file]}" if $DEBUG
+    File.open @ca_config[:cert_file], "w", 0644 do |f|
+      f << cert.to_pem
+    end
+    puts "Done generating certificate for #{cert.subject}" if $DEBUG
+  end
+  ##
+  # Creates a new RSA key from +cert_config+.
+  def create_key(cert_config)
+    dest = cert_config[:hostname] || cert_config[:user]
+    keypair_file = "#{CERT_DIR}/#{dest}/#{dest}_keypair.pem"
+    if File.exists?(keypair_file)
+      keypair = OpenSSL::PKey::RSA.new(File.read(keypair_file),
+                                       cert_config[:password])
+      return keypair_file, keypair
+    end
+    Dir.mkdir("#{CERT_DIR}/#{dest}", 0700) unless File.exists?("#{CERT_DIR}/#{dest}")
+    puts "Generating RSA keypair" if $DEBUG
+    keypair = OpenSSL::PKey::RSA.new 1024
+    if cert_config[:password].nil? then
+      File.open keypair_file, "w", 0400 do |f|
+        f << keypair.to_pem
+      end
+    else
+      keypair_export = keypair.export(OpenSSL::Cipher::DES.new(:EDE3, :CBC),
+                                      cert_config[:password])
+      puts "Writing keypair to #{keypair_file}" if $DEBUG
+      File.open keypair_file, "w", 0400 do |f|
+        f << keypair_export
+      end
+    end
+    return keypair_file, keypair
+  end
+  ##
+  # Creates a new Certificate Signing Request for the keypair in
+  # +keypair_file+, generating and saving new keypair if nil.
+  def create_csr(cert_config, keypair_file = nil)
+    keypair = nil
+    dest = cert_config[:hostname] || cert_config[:user]
+    csr_file = "#{CERT_DIR}/#{dest}/csr_#{dest}.pem"
+    name = @ca_config[:name].dup
+    case cert_config[:type]
+    when 'server' then
+      name << ['OU', 'CA']
+      name << ['CN', cert_config[:hostname]]
+    when 'client' then
+      name << ['CN', cert_config[:user]]
+      name << ['emailAddress', cert_config[:email]]
+    end
+    name = OpenSSL::X509::Name.new name
+    if File.exists? keypair_file then
+      keypair = OpenSSL::PKey::RSA.new(File.read(keypair_file),
+                                       cert_config[:password])
+    else
+      keypair = create_key cert_config
+    end
+    puts "Generating CSR for #{name}" if $DEBUG
+    req = OpenSSL::X509::Request.new
+    req.version = 0
+    req.subject = name
+    req.public_key = keypair.public_key
+    req.sign keypair, OpenSSL::Digest::MD5.new
+    puts "Writing CSR to #{csr_file}" if $DEBUG
+    File.open csr_file, "w" do |f|
+      f << req.to_pem
+    end
+    return csr_file
+  end
+  ##
+  # Signs the certificate described in +cert_config+ and
+  # +csr_file+, saving it to +cert_file+.
+  def sign_cert(cert_config, cert_file, csr_file)
+    csr = OpenSSL::X509::Request.new File.read(csr_file)
+    raise "CSR sign verification failed." unless csr.verify csr.public_key
+    if csr.public_key.n.num_bits < @ca_config[:cert_key_length_min] then
+      raise "Key length too short"
+    end
+    if csr.public_key.n.num_bits > @ca_config[:cert_key_length_max] then
+      raise "Key length too long"
+    end
+    if csr.subject.to_a[0, @ca_config[:name].size] != @ca_config[:name] then
+      raise "DN does not match"
+    end
+    # Only checks signature here.  You must verify CSR according to your
+    # CP/CPS.
+    # CA setup
+    puts "Reading CA cert from #{@ca_config[:cert_file]}" if $DEBUG
+    ca = OpenSSL::X509::Certificate.new File.read(@ca_config[:cert_file])
+    puts "Reading CA keypair from #{@ca_config[:keypair_file]}" if $DEBUG
+    ca_keypair = OpenSSL::PKey::RSA.new File.read(@ca_config[:keypair_file]),
+                                        @ca_config[:password]
+    serial = File.read(@ca_config[:serial_file]).chomp.hex
+    File.open @ca_config[:serial_file], "w" do |f|
+      f << "%04X" % (serial + 1)
+    end
+    puts "Generating cert" if $DEBUG
+    cert = OpenSSL::X509::Certificate.new
+    from = Time.now
+    cert.subject = csr.subject
+    cert.issuer = ca.subject
+    cert.not_before = from
+    cert.not_after = from + @ca_config[:cert_days] * 24 * 60 * 60
+    cert.public_key = csr.public_key
+    cert.serial = serial
+    cert.version = 2 # X509v3
+    basic_constraint = nil
+    key_usage = []
+    ext_key_usage = []
+    case cert_config[:type]
+    when "ca" then
+      basic_constraint = "CA:TRUE"
+      key_usage << "cRLSign" << "keyCertSign"
+    when "terminalsubca" then
+      basic_constraint = "CA:TRUE,pathlen:0"
+      key_usage << "cRLSign" << "keyCertSign"
+    when "server" then
+      basic_constraint = "CA:FALSE"
+      key_usage << "digitalSignature" << "keyEncipherment"
+      ext_key_usage << "serverAuth"
+    when "ocsp" then
+      basic_constraint = "CA:FALSE"
+      key_usage << "nonRepudiation" << "digitalSignature"
+      ext_key_usage << "serverAuth" << "OCSPSigning"
+    when "client" then
+      basic_constraint = "CA:FALSE"
+      key_usage << "nonRepudiation" << "digitalSignature" << "keyEncipherment"
+      ext_key_usage << "clientAuth" << "emailProtection"
+    else
+      raise "unknonw cert type \"#{cert_config[:type]}\""
+    end
+    ef = OpenSSL::X509::ExtensionFactory.new
+    ef.subject_certificate = cert
+    ef.issuer_certificate = ca
+    ex = []
+    ex << ef.create_extension("basicConstraints", basic_constraint, true)
+    ex << ef.create_extension("nsComment",
+                              "Ruby/OpenSSL Generated Certificate")
+    ex << ef.create_extension("subjectKeyIdentifier", "hash")
+    #ex << ef.create_extension("nsCertType", "client,email")
+    unless key_usage.empty? then
+      ex << ef.create_extension("keyUsage", key_usage.join(","))
+    end
+    #ex << ef.create_extension("authorityKeyIdentifier",
+    #                          "keyid:always,issuer:always")
+    #ex << ef.create_extension("authorityKeyIdentifier", "keyid:always")
+    unless ext_key_usage.empty? then
+      ex << ef.create_extension("extendedKeyUsage", ext_key_usage.join(","))
+    end
+    if @ca_config[:cdp_location] then
+      ex << ef.create_extension("crlDistributionPoints",
+                                @ca_config[:cdp_location])
+    end
+    if @ca_config[:ocsp_location] then
+      ex << ef.create_extension("authorityInfoAccess",
+                                "OCSP;" << @ca_config[:ocsp_location])
+    end
+    cert.extensions = ex
+    cert.sign(ca_keypair, OpenSSL::Digest::SHA1.new)
+    backup_cert_file = @ca_config[:new_certs_dir] + "/cert_#{cert.serial}.pem"
+    puts "Writing backup cert to #{backup_cert_file}" if $DEBUG
+    File.open backup_cert_file, "w", 0644 do |f|
+      f << cert.to_pem
+    end
+    # Write cert
+    dest = cert_config[:hostname] || cert_config[:user]
+    cert_file = "#{CERT_DIR}/#{dest}/cert_#{dest}.pem"
+    puts "Writing cert to #{cert_file}" if $DEBUG
+    File.open cert_file, "w", 0644 do |f|
+      f << cert.to_pem
+    end
+    return cert_file, cert
+  end
+end # class QuickCert

data/lib/evil-proxy/version.rb CHANGED

@@ -1,3 +1,3 @@
 module EvilProxy
-  VERSION = "0.0.2"
+  VERSION = "0.0.3"
 end

metadata CHANGED

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: evil-proxy
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Theo
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2015-08-05 00:00:00.000000000 Z
+date: 2015-11-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -38,10 +38,25 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: A ruby http proxy to do EVIL things.
+- !ruby/object:Gem::Dependency
+  name: pry-byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: A ruby http/https proxy, with SSL MITM support.
 email:
 - bbtfrr@gmail.com
-executables: []
+executables:
+- evil-proxy
 extensions: []
 extra_rdoc_files: []
 files:
@@ -50,11 +65,15 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- bin/evil-proxy
 - evil-proxy.gemspec
 - lib/evil-proxy.rb
+- lib/evil-proxy/agentproxy.rb
 - lib/evil-proxy/async.rb
 - lib/evil-proxy/httpproxy.rb
 - lib/evil-proxy/httprequest.rb
+- lib/evil-proxy/mitmproxy.rb
+- lib/evil-proxy/quickcert.rb
 - lib/evil-proxy/selenium.rb
 - lib/evil-proxy/store.rb
 - lib/evil-proxy/version.rb
@@ -81,5 +100,5 @@ rubyforge_project:
 rubygems_version: 2.4.6
 signing_key:
 specification_version: 4
-summary: A ruby http proxy to do EVIL things.
+summary: A ruby http/https proxy to do EVIL things.
 test_files: []