The Un-Official Proxomitron Forum

I'm working on adapting proxo 4.5 to the latest OpenSSL and right now I'm a little bit excited because I think a have certain success. How do I properly test if everything is ok?

(Oct. 14, 2014 08:20 PM)mas Wrote: [ -> ]I'm working on adapting proxo 4.5 to the latest OpenSSL and right now I'm a little bit excited because I think a have certain success. How do I properly test if everything is ok?

Are you saying you have modified the Proxomitron exe to use the current OpenSSL DLLs?

http://www.dependencywalker.com/

Edit: Added link to Dependency Walker aka depends.exe

(Oct. 15, 2014 04:23 AM)JJoe Wrote: [ -> ]

(Oct. 14, 2014 08:20 PM)mas Wrote: [ -> ]I'm working on adapting proxo 4.5 to the latest OpenSSL and right now I'm a little bit excited because I think a have certain success. How do I properly test if everything is ok?

Are you saying you have modified the Proxomitron exe to use the current OpenSSL DLLs?

Yes, so far so good - not without hiccups with mail.google.com, but that's probably my settings, with filters off runs fine. OpenSSL's version 1.0.1.9.

(Oct. 15, 2014 04:23 AM)JJoe Wrote: [ -> ]http://www.dependencywalker.com/

Edit: Added link to Dependency Walker aka depends.exe

I know this app, what's with it?

(Oct. 15, 2014 05:47 AM)mas Wrote: [ -> ]Yes, so far so good

Interesting. It's been years since I gave up on this. IIRC...
The Proxomitron checks cert name matching. Unfortunately, Proxo doesn't understand wild card certs or SubjectAltName ( http://en.wikipedia.org/wiki/SubjectAltName ).
How did you handle this?

The last known "usable" DLL was patched to make it compatible.
Are you using an unaltered OpenSSL version 1.0.1.9 DLL?
Where did you find it?

(Oct. 15, 2014 05:47 AM)mas Wrote: [ -> ]I know this app, what's with it?

I used it to monitor the Proxomitron while handled https. Dependency Walker showed unanswered requests to OpenSSL, errors, etc.

A working DLL would have been tested by verifying encryption and correct behavior but it never got that far. Even if, a "Use at own risk" warning would have been necessary.

Encryption might be verified by
https://cc.dcsec.uni-hannover.de/
https://www.fortify.net/sslcheck.html
or a network sniffer.
You could use known attacks and incorrectly configured servers to test behavior.

http://stackoverflow.com/questions/17279...certificat

Edit: I'll be moving these posts to their own thread.

JJoe, please check your PM

Looks good.

The patched Proxomitron exe is using the latest libeay32.dll and ssleay32.dll from https://slproweb.com/products/Win32OpenSSL.html .
The Proxomitron's log window shows the change and various web tests confirm it.

I haven't noticed any new problems. The old problems remain, however.

To try mas's mod, overwrite


from 0000E580 through 0000E60F with


Use at own risk! Report problems.

Before:

After:

what advantages are there, if any, to patching to use the latest OpenSSL?

(Nov. 01, 2014 05:02 AM)ProxRocks Wrote: [ -> ]what advantages are there, if any, to patching to use the latest OpenSSL?

Latest OpenSSL is "TLSv1.2" while Proxo's old is TLSv1 or older.
Some advantages are quality and quantity of ciphers, Proxomitron's traffic may be less odd, and ability to access more sites.

More info at
https://www.howsmyssl.com/
https://www.howsmyssl.com/s/about.html .

Patching will not gain best practice security, however. Some old problems remain. So be aware regardless.

Before:

After:

For confirmation purposes, are these correct?
Original Proxomitron.exe:
MD5 f2867bee7180cdc839f7636fddc1aa74
SHA-256 7adc0296d97e24417000c5cac53c8dfb34a5e6ddedceec168ffe45648803285b

Edited Proxomitron.exe:
MD5 bc3407620d6abbfa5095668e40f03e8c
SHA-256 7b916181145b0f63dca29f72fe5e09e3bd3cfe61e994e7b384d3d2068dc01c33

(Nov. 01, 2014 10:26 PM)herbalist Wrote: [ -> ]For confirmation purposes, are these correct?

Yes.

(Nov. 01, 2014 06:22 PM)JJoe Wrote: [ -> ]Some old problems remain. So be aware regardless.

What old problems do you mean?

It appears to work on a virtual XP. On 98SE, it doesn't find or recognize ssleay32.dll. Using Dependency Walker, I could see the original DLLs using msvcr70.dll, a copy of which is in the Proxomitron folder. The new DLLs want msvcr90.dll, which is installed, obtained from https://slproweb.com/products/Win32OpenSSL.html, which was also copied to the Proxomitron folder.
I've tried copies of msvcr90.dll from both the 98 and XP systems using all the available KernelEx options. DW reports "device not functioning". According to the site, OpenSSL is still compatible with 98, as are the DLLs. Any ideas what I'm overlooking?

(Nov. 02, 2014 04:10 AM)whenever Wrote: [ -> ]What old problems do you mean?

1. Current browsers complain about Proxo's cert. (HalfSSL can help but in practice can cause usabilty and security problems.)
2. Original Proxomitron throws an alert for wild card certs, certs that require alternate name support, and maybe any options that it does not support.
3. Some patched Proxomitron exes do not throw alerts for certs.
4. Proxo with OpenSSL DLLs from slproweb still supports ciphers that some people believe are insufficient.

4, 3, and possibly 2 are security related, while 1 and 2 are usability problems.

This patch doesn't solve any of these problems.

ProxHTTPSProxyMII doesn't have these problems.

Edit:
I should have said 'my ProxHTTPSProxyMII doesn't have these problems.'
I changed line 54 of ProxHTTPSProxy.pyv1.1b from
to
Result is "Your SSL client is Probably Okay." at https://www.howsmyssl.com/ .
Before the change, I saw "Your SSL client is Bad." due to TLSv1 use.
I have not noticed any problems after the change.

(Nov. 02, 2014 04:43 PM)herbalist Wrote: [ -> ]According to the site, OpenSSL is still compatible with 98, as are the DLLs. Any ideas what I'm overlooking?

They do say that but the link to "Visual C++ 2008 Redistributables for Windows 9x/NT4" is "https://slproweb.com/download/RunMagic.zip" and the instructions are

Quote:Having problems with error messages when trying to run OpenSSL? This will likely fix the problem. Only use under Windows 95, 98, Me, and NT4.
Install this, then install "OpenSSL Light" using the '/bin' option, and then run FixSSL_9xNT4.bat contained within the /bin directory.

Gotta wonder what is in "FixSSL_9xNT4.bat".

After trying above, I'd ensure a copy of msvcr in c:\windows\system.

I don't have any experience with KernelEx.
My 98 machines are parts, atm.

Both the 70 and 90 versions are in the system folder and in the Proxomitron folder.
Regarding

Quote:Install this, then install "OpenSSL Light" using the '/bin' option, and then run FixSSL_9xNT4.bat contained within the /bin directory.

I'm wondering if I have to run that every time I update OpenSSL. I'm sure that OpenSSL works on this PC. Tor uses OpenSSL and this PC is an exit node.