Doubts about HTTPS requests and Java proxy

Question

Hello,
I need help about SSL connections and Java.
I'm developing a HTTP/S proxy with Java. To test my proxy, I use Firefox. I configure the proxy option in the browser. The proxy works good with HTTP requests, but with HTTPS requests doesn't work and I don't know why.
I explain the steps that I do for a HTTPS request:
* The browser sends a CONNECT message to the proxy.
I check that the proxy receives the CONNECT request correctly.
* The proxy establish a secure connection with the content server.
I use an SSLSocket to connect with my content server, and the SSL handshake is succesful.
* The proxy sends a 200 HTTP response to the client:
I send
HTTP/1.0 200 Connection established[CRLF]
[CRLF]
to the application client (Firefox)
* The proxy sends/receive data to/from Firefox/content server
I have a Socket between Firefox and my proxy, and a SSLSocket between my proxy and my content server. I use two threads to communicate the client and the server.
Java code:
//Thead server-->proxy-->application(Firefox)
ThreadComm tpa = new ThreadComm(bis_serverSSL, bos_app);
//Thread application(Firefox)-->proxy-->server
ThreadComm tap = new ThreadComm(bis_app, bos_serverSSL);
The "tpa" thread reads from the SSLSocket between the proxy and the server and sends data to the Socket between the proxy and Firefox.
The "tap" thread reads from the Socket between the proxy and Firefox and sends data to the SSLSocket between the proxy and the server.
This is the class ThreadComm:
public class ThreadComm extends Thread{
    private BufferedInputStream bis = null;
    private BufferedOutputStream bos = null;
    public ThreadComm(BufferedInputStream bis, BufferedOutputStream bos) {
        this.bis = bis;
        this.bos = bos;
    @Override
    public void run() {
        int b = -1;
        FileOutputStream fos = null;
          do {
               try {
                    b = bis.read();
                    System.out.print((char) b);
                    fos.write(b);
                    bos.write(b);
                    bos.flush();
               } catch (Exception ex) {
                    Logger.getLogger(ThreadAplicacionProxy.class.getName()).log(Level.SEVERE, null, ex);
                    //b=-1;
          } while (b != -1);
    }But this doesn't work and I don't know why.      
I have an Apache server with the mod_ssl enabled as content server, I can send requests (with Firefox) to the port 80(HTTP request) and 443(HTTPS request) without use my proxy and it works. If I use my proxy, HTTP request works but with HTTPS request doesn't work, I look the log of Apache and I see:
[Tue Apr 27 17:32:03 2010] [info] Initial (No.1) HTTPS request received for child 62 (server localhost:443)
[Tue Apr 27 17:32:03 2010] [error] [client 127.0.0.1] Invalid method in request \x80\x7f\x01\x03\x01
[Tue Apr 27 17:32:03 2010] [debug] ssl_engine_kernel.c(1770): OpenSSL: Write: SSL negotiation finished successfully
[Tue Apr 27 17:32:03 2010] [info] [client 127.0.0.1] Connection closed to child 62 with standard shutdown (server localhost:443)
Why it say? Invalid method in request \x80\x7f\x01\x03\x01 , my proxy sends the data that the Firefox sends.
I think than I have follow the explanations of [1] but doesn't work, I have problems in implementation in Java but I don't know where.
I appreciate any suggestions.
Thanks for your time.
[1] http://www.web-cache.com/Writings/Internet-Drafts/draft-luotonen-web-proxy-tunneling-01.txt

Answer 1

ejp, I have checked the socket between the proxy and server and ... You are right! , I was using the port 80 instead of the 443 (incredible mistake!, I'm sorry). I was convinced that I was using the port 443... Well, is a little step, but I still have not won the war :)
If I see the log files of Apache, We can see that something goes wrong.
localhost-access.log
>
127.0.0.1 - - [04/May/2010:17:44:48 +0200] "\x 80\x 7f\x01\x03\x01" 501 219
>
localhost-error.log
>
[Tue May 04 17:44:48 2010] [info] Initial (No.1) HTTPS request received for child 63 (server localhost:443)
[Tue May 04 17:44:48 2010] [error] [client 127.0.0.1] Invalid method in request \x80\x7f\x01\x03\x01
[Tue May 04 17:44:48 2010] [debug] ssl_engine_kernel.c(1770): OpenSSL: Write: SSL negotiation finished successfully
[Tue May 04 17:44:48 2010] [info] [client 127.0.0.1] Connection closed to child 63 with standard shutdown (server localhost:443)
>
I think that this happens because Apache receives the data without decrypt, this is the reason because in the log we can see the "Invalid method in request \x80\x7f\x01\x03\x01". This supposition is true?
ejp, you say that the "Termination is quite tricky." I have changed my code following yours suggestions (using the join and the shutdownOutput) but the threads don't die.
I explain you what I do:
(in time 1)
I launch the thread (threadFirefoxToApache) that reads data from Firefox and sends to Apache.
I launch the thread (threadApacheToFirefox) that reads data from Apache and sends to Firefox.
(in time 2)
threadFirefoxToApache sends the firts data to the server.
threadApacheToFirefox is waiting that the server says something.
(in time 3)
threadFirefoxToApache is waiting that Firefox says something.
threadApacheToFirefox sends data to Firefox.
(in time 4)
threadFirefoxToApache is waiting that Firefox says something.
threadApacheToFirefox is waiting that Firefox says something.
and they are waiting... and never finish.
In time 2, these first data are encrypted. The server receives these data and It doesn't understand. In time 3, the server sends a HTTP response "501 Method Not Implemented", here there is a problem because this data must be encrypt. According to the documentation that I read, the proxy cannot "understand" this data but I can "understand" this data. What's happen?
Firefox encrypt the data and send to the proxy. This It's correct.
The proxy encrypt the data another time, because I use the SSLSocket to send the data to the server. Then the server receives the data encrypted two times, when decrypt the data gets the data encrypted one time. And this is the reason why the server doesn't understand the data that sends Firefox. It's correct? May be.
Then If I want that the server receives the data encrypted one time I need to use the socketToServer, It's correct?
I will supposed that yes. If I use the socketToServer, the proxy doesn't understand nothing, because the data received from the socketToServer are encrypted (I only see simbols), but the Apache log says that there is a problem with the version? (If I use the socketToServer the threads die)
>
[Tue May 04 19:55:42 2010] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 read finished A
[Tue May 04 19:55:42 2010] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write change cipher spec A
[Tue May 04 19:55:42 2010] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write finished A
[Tue May 04 19:55:42 2010] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 flush data
[Tue May 04 19:55:42 2010] [debug] ssl_engine_kernel.c(1756): OpenSSL: Handshake: done
[Tue May 04 19:55:42 2010] [info] Connection: Client IP: 127.0.0.1, Protocol: TLSv1, Cipher: RC4-MD5 (128/128 bits)
[Tue May 04 19:55:42 2010] [debug] ssl_engine_io.c(1817): OpenSSL: read 5/5 bytes from BIO#29bd910 [mem: 29ea0a8] (BIO dump follows)
[Tue May 04 19:55:42 2010] [debug] ssl_engine_io.c(1750): -------------------------------------------------------------------------
[Tue May 04 19:55:42 2010] [debug] ssl_engine_io.c(1789): | 0000: 80 7f 01 03 .... |
[Tue May 04 19:55:42 2010] [debug] ssl_engine_io.c(1793): | 0005 - <SPACES/NULS>
[Tue May 04 19:55:42 2010] [debug] ssl_engine_io.c(1795): ------------------------------------------------------------------------
[Tue May 04 19:55:42 2010] [debug] ssl_engine_kernel.c(1770): OpenSSL: Write: SSL negotiation finished successfully
[Tue May 04 19:55:42 2010] [info] [client 127.0.0.1] SSL library error 1 reading data
[Tue May 04 19:55:42 2010] [info] SSL Library Error: 336130315 error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
[Tue May 04 19:55:42 2010] [debug] ssl_engine_kernel.c(1770): OpenSSL: Write: SSL negotiation finished successfully
[Tue May 04 19:55:42 2010] [info] [client 127.0.0.1] Connection closed to child 63 with standard shutdown (server localhost:443)
>
What option is the correct? I need use the SSLSocketToServer or socketToServer to send/read the data to/from the server?. Use the SSLSocket has sense because the data travel in a secure socket, but use the Socket also has sense because the data are encrypted and they are protected by this encription. It's complicated...