mandatoryprogrammer / mandatoryprogrammer/xsshunter_client

Fixed with a Kludge - Far from Ideal!

Open
#2 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
259
Forks
53
PR merge metrics
No merged PRs in 30d

Description

Hello,

I thought this a very cool tool, so I manged to get this working 'as is' with a kludge.

Long story, short - openssl has changed quite a bit in the last few years and the any recent versions break the old version of cryptography specified. I found a way of adding and linking an old (and insecure) version of openssl to the python env and the required libraries without having to disturb the up-to-date system version:

# Modified from the code at: https://github.com/pyca/cryptography/blob/master/docs/installation.rst#static-wheels
# Tested with Python2 (2.7.15+) and pip2 (18.0) current at  05 Sept 2018 

set -e

OPENSSL_VERSION="1.0.1m"
CWD=$(pwd)

pip2 install -U setuptools
pip2 install -U wheel pip
curl -O https://www.openssl.org/source/old/1.0.1/openssl-${OPENSSL_VERSION}.tar.gz
tar xvf openssl-${OPENSSL_VERSION}.tar.gz
cd openssl-${OPENSSL_VERSION}
./config no-shared -fPIC --prefix=${CWD}/openssl
make && make install
cd ..
CFLAGS="-I${CWD}/openssl/include" LDFLAGS="-L${CWD}/openssl/lib" pip2 wheel --no-binary :all: 
  cryptography==1.1.2 argh==0.26.1 backports-abc==0.4 backports.ssl-match-hostname==3.5.0.1 
  blinker==1.4 certifi==2016.2.28 cffi==1.5.2 click==6.2 ConfigArgParse==0.10.0 construct==2.5.2 
  enum34==1.1.2 futures==3.0.5 hpack==2.0.1 html2text==2015.11.4 idna==2.0 ipaddress==1.0.16 
  lxml==3.4.4 mitmproxy==0.15 ndg-httpsclient==0.4.0 netlib==0.15.1 passlib==1.6.5 pathtools==0.1.2 
  Pillow==3.0.0 pyasn1==0.1.9 pycparser==2.14 pyOpenSSL==0.15.1 pyparsing==2.0.7 
  pyperclip==1.5.26 PyYAML==3.11 requests==2.9.1 requests-futures==0.9.7 singledispatch==3.4.0.3 
  six==1.10.0 tornado==4.3 urwid==1.3.1 watchdog==0.8.3 wheel==0.24.0

This compiles and links everything together and creates a bunch of .whl (wheel) files in the installation directory as a side effect - run this instead of step 4 in the setup instructions.

As it is not really a proper fix, I haven't forked it into the code. Just left it here on an 'as is' basis. Note that you must only use this fix in a Python env so as not to replace your system SSL library with an old insecure one!

When I have some time, I might try getting this running with the most recent consistent versions of all the libraries in requirements.txt such that the current system installed versions of openssl works (this will likely need a few changes to the code). If I have any success with that, I will look at forking into the code.

Cheers.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with requirements.txt and the setup instructions, especially step 4; reproduce the Python 2 dependency build against a current system OpenSSL. Compare the pinned cryptography and related packages with compatible versions, then verify installation and tool startup without the old OpenSSL workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.