Transparent Ssl Proxy
sonertari/SSLproxy: Transparent SSL/TLS proxy for … – GitHub
Copyright (C) 2017-2021, Soner Tari.
Copyright (C) 2009-2019, Daniel Roethlisberger.
Overview
SSLproxy is a proxy for SSL/TLS encrypted network connections. It is intended
to be used for decrypting and diverting network traffic to other programs, such
as UTM services, for deep SSL inspection.
The UTMFW project uses SSLproxy to
decyrpt and feed network traffic into its UTM services: Web Filter, POP3
Proxy, SMTP Proxy, and Inline IPS; and also indirectly into Virus Scanner and
Spam Filter through those UTM software. Given that most of the Internet
traffic is encrypted now, it wouldn’t be possible without SSLproxy to deeply
inspect most of the network traffic passing through UTMFW.
See this presentation
for a summary of SSL interception and potential issues with middleboxes that
support it.
Mode of operation
SSLproxy is designed to transparently terminate connections that are redirected
to it using a network address translation engine. SSLproxy then terminates
SSL/TLS and initiates a new SSL/TLS connection to the original destination
address. Packets received on the client side are decrypted and sent to the
program listening on a port given in the proxy specification. SSLproxy inserts
in the first packet the address and port it is expecting to receive the packets
back from the program. Upon receiving the packets back, SSLproxy re-encrypts
and sends them to their original destination. The return traffic follows the
same path back to the client in reverse order.
This is similar in principle to divert
sockets, where the packet filter diverts the
packets to a program listening on a divert socket, and after processing the
packets the program reinjects them into the kernel. If there is no program
listening on that divert socket or the program does not reinject the packets
into the kernel, the connection is effectively blocked. In the case of
SSLproxy, SSLproxy acts as both the packet filter and the kernel, and the
communication occurs over networking sockets.
SSLproxy supports split mode of operation similar to SSLsplit as well. In
split mode, packets are not diverted to listening programs, effectively making
SSLproxy behave similar to SSLsplit, but not exactly like it, because SSLproxy
has certain features non-existent in SSLsplit, such as user authentication and
protocol validation. Also, note that the implementation of proxy core in
SSLproxy is different from the one in SSLsplit, for example the proxy core in
SSLproxy runs lockless, whereas SSLsplit implementation uses thread manager
level locks (which does not necessarily make sslproxy run faster than
sslsplit). In SSLproxy, split mode can be defined globally or per-proxyspec.
SSLproxy does not automagically redirect any network traffic. To actually
implement a proxy, you also need to redirect the traffic to the system running
sslproxy. Your options include running sslproxy on a legitimate router, ARP
spoofing, ND spoofing, DNS poisoning, deploying a rogue access point (e. g.
using hostap mode), physical recabling, malicious VLAN reconfiguration or
route injection, /etc/hosts modification and so on.
Proxy specification
For example, given the following proxy specification:
127. 0. 1 8443 up:8080
SSLproxy listens for HTTPS connections on 127. 1:8443.
Upon receiving a connection from the Client, it decrypts and diverts the
packets to a Program listening on 127. 1:8080. The default divert address
is 127. 1, which can be configured by the ua option.
After processing the packets, the Program gives them back to SSLproxy
listening on a dynamically assigned address, which the Program obtains from
the SSLproxy line in the first packet in the connection.
Then SSLproxy re-encrypts and sends the packets to the Server.
The response from the Server follows the same path back to the Client in
reverse order.
See the SSLsplit documentation for split style proxyspecs.
SSLproxy line
A sample line SSLproxy inserts into the first packet in the connection is the
following:
SSLproxy: [127. 1]:34649, [192. 168. 3. 24]:47286, [192. 111. 130]:443, s
The first IP:port pair is a dynamically assigned address that SSLproxy
expects the program send the packets back to it.
The second and third IP:port pairs are the actual source and destination
addresses of the connection respectively. Since the program receives the
packets from SSLproxy, it cannot determine the source and destination
addresses of the packets by itself, e. g by asking the NAT engine, hence must
rely on the information in the SSLproxy line.
The last letter is either s or p, for SSL/TLS encrypted or plain traffic
respectively. This information is also important for the program, because it
cannot reliably determine if the actual network traffic it is processing was
encrypted or not before being diverted to it.
Listening program
The program that packets are diverted to should support this mode of operation.
Specifically, it should be able to recognize the SSLproxy address in the first
packet, and give the first and subsequent packets back to SSLproxy listening
on that address, instead of sending them to the original destination as it
normally would.
You can use any software as a listening program as long as it supports this
mode of operation. So existing or new software developed in any programming
language can be modified to be used with SSLproxy to inspect and/or modify any
or all parts of the packets diverted to it.
You can offload the system SSLproxy is running on by diverting packets to
remote listening programs too. For example, given the following proxy
specification:
127. 1 8443 up:8080 ua:192. 1 ra:192. 1. 1
The ua option instructs SSLproxy to divert packets to 192. 1:8080,
instead of 127. 1:8080 as in the previous proxyspec example.
The ra option instructs SSLproxy to listen for returned packets from the
program on 192. 1, instead of 127. 1 as in the previous SSLproxy line.
Accordingly, the SSLproxy line now becomes:
SSLproxy: [192. 130]:443, s
So, the listening program can be running on a machine anywhere in the world.
Since the packets between SSLproxy and the listening program are always
unencrypted, you should be careful while using such a setup.
Protocols
Supported protocols
SSLproxy supports plain TCP, plain SSL, HTTP, HTTPS, POP3, POP3S, SMTP, and
SMTPS connections over both IPv4 and IPv6. It also has the ability to
dynamically upgrade plain TCP to SSL in order to generically support SMTP
STARTTLS and similar upgrade mechanisms. Depending on the version of OpenSSL,
SSLproxy supports SSL 3. 0, TLS 1. 1, TLS 1. 2, and TLS 1. 3, and
optionally SSL 2. 0 as well. SSLproxy supports Server Name Indication (SNI),
but not Encrypted SNI in TLS 1. It is able to work with RSA, DSA and ECDSA
keys and DHE and ECDHE cipher suites.
The following features of SSLproxy are IPv4 only:
Divert addresses for listening programs in proxyspecs
SSLproxy return addresses dynamically assigned to connections
IP addresses in the ua and ra options
IP and ethernet addresses of clients in user authentication
Target IP and ethernet addresses in mirror logging
OCSP, HPKP, HSTS, Upgrade et al.
SSLproxy implements a number of defences against mechanisms which would
normally prevent MitM attacks or make them more difficult. SSLproxy can deny
OCSP requests in a generic way. For HTTP and HTTPS connections, SSLproxy
mangles headers to prevent server-instructed public key pinning (HPKP), avoid
strict transport security restrictions (HSTS), avoid Certificate Transparency
enforcement (Expect-CT) and prevent switching to QUIC/SPDY, HTTP/2 or
WebSockets (Upgrade, Alternate Protocols). HTTP compression, encodings and
keep-alive are disabled to make the logs more readable.
Another reason to disable persistent connections is to reduce file descriptor
usage. Accordingly, connections are closed if they remain idle for a certain
period of time. The default timeout is 120 seconds, which can be configured by
the ConnIdleTimeout option.
Protocol validation
Protocol validation makes sure the traffic handled by a proxyspec is using the
protocol specified in that proxyspec. The ValidateProto option can be used to
enable global and/or per-proxyspec protocol validation. This feature currently
supports HTTP, POP3, and SMTP protocols. If a connection cannot pass protocol
validation, then it is terminated.
SSLproxy uses only client requests for protocol validation. However, it also
validates SMTP responses until it starts processing the packets from the
client. If there is no excessive fragmentation, the first couple of packets in
the connection should be enough for validating protocols.
Certificates
Certificate forging
For SSL and HTTPS connections, SSLproxy generates and signs forged X509v3
certificates on-the-fly, mimicking the original server certificate’s subject
DN, subjectAltName extension and other characteristics. SSLproxy has the
ability to use existing certificates of which the private key is available,
instead of generating forged ones. SSLproxy supports NULL-prefix CN
certificates but otherwise does not implement exploits against specific
certificate verification vulnerabilities in SSL/TLS stacks.
Certificate verification
SSLproxy verifies upstream certificates by default. If the verification fails,
the connection is terminated immediately. This is in contrast to SSLsplit,
because in order to maximize the chances that a connection can be successfully
split, SSLsplit accepts all certificates by default, including self-signed
ones. See The Risks of SSL Inspection
for the reasons of this difference. You can disable this feature by the
VerifyPeer option.
Client certificates
SSLproxy uses the certificate and key from the pemfiles configured by the
ClientCert and ClientKey options when the destination requests client
certificates. These options can be defined globally and/or per-proxyspec.
Alternatively, you can use the PassSite option to pass through certain
destinations requesting client certificates.
User authentication
If the UserAuth option is enabled, SSLproxy requires network users to log in
to the system to establish connections to the external network.
SSLproxy determines the user owner of a connection using a users table in an
SQLite3 database configured by the UserDBPath option. The users table should
be created using the following SQL statement:
CREATE TABLE USERS(
IP CHAR(45) PRIMARY KEY NOT NULL,
USER CHAR(31) NOT NULL,
ETHER CHAR(17) NOT NULL,
ATIME INT NOT NULL,
DESC CHAR(50));
SSLproxy does not create this users table or the database file by itself, nor
does it log users in or out. So the database file and the users table should
already exist at the location pointed to by the UserDBPath option. An external
program should log users in and out on the users table. The external program
should fill out all the fields in user records, except perhaps for the DESC
field, which can be left blank.
When SSLproxy accepts a connection,
It searches the client IP address of the connection in the users table. If
the client IP address is not in the users table, the connection is redirected
to a login page configured by the UserAuthURL option.
If SSLproxy finds a user record for the client IP address in the users
table, it obtains the ethernet address of the client IP address from the arp
cache of the system, and compares it with the value in the user record for
that IP address. If the ethernet addresses do not match, the connection is
redirected to the login page.
If the ethernet addresses match, SSLproxy compares the atime value in the
user record with the current system time. If the difference is greater than
the value configured by the UserTimeout option, the connection is redirected
to the login page.
If the connection passes all these checks, SSLproxy proceeds with establishing
the connection.
The atime of the IP address in the users table is updated with the system time
while the connection is being terminated. Since this atime update is executed
using a privsep command, it is expensive. So, to reduce the frequency of such
updates, it is deferred until after the user idle time is more than half of
the timeout period.
If a description text is provided in the DESC field, it can be used with the
PassSite option to treat the user logged in from different locations, i. e.
from different client IP addresses, separately.
If the UserAuth option is enabled, the user owner of the connection is
appended at the end of the SSLproxy line, so that the listening program can
parse and use this information in its logic and/or logging:
SSLproxy: [127. 130]:443, s, soner
The user authentication feature is currently available on OpenBSD and Linux only.
User control lists
DivertUsers and PassUsers options can be used to divert, pass through, or
block users.
If neither DivertUsers nor PassUsers is defined, all users are diverted to
listening programs.
Connections from users in DivertUsers, if defined, are diverted to listening
programs.
Connections from users in PassUsers, if defined, are simply passed through
to their original destinations. SSLproxy engages the Passthrough mode for that
purpose.
If both DivertUsers and PassUsers are defined, users not listed in either of
the lists are blocked. SSLproxy simply terminates their connections.
If no DivertUsers list is defined, only users not listed in PassUsers
are diverted to listening programs.
These user control lists can be defined globally or per-proxyspec.
Excluding sites from SSL inspection
PassSite option allows certain SSL sites to be excluded from SSL inspection.
If a PassSite matches the SNI or common names in the SSL certificate of a
connection, that connection is passed through the proxy without being diverted
to the listening program. SSLproxy engages the Passthrough mode for that
purpose. For example, sites requiring client authentication can be added as
PassSite.
Per-site filters can be defined using client IP addresses, users, and
description keywords. If the UserAuth option is disabled, only client IP
addresses can be used in PassSite filters. Multiple sites can be defined, one
on each line. PassSite rules can search for exact or substring matches.
Logging
Logging options include traditional SSLproxy connect and content log files as
well as PCAP files and mirroring decrypted traffic to a network interface.
Additionally, certificates, master secrets and local process information can be
logged.
See the manual pages sslproxy(1) and (5) for details on using
SSLproxy, setting up the various NAT engines, and for examples.
Requirements
SSLproxy depends on the OpenSSL, libevent 2. x, libpcap, libnet 1. x, and
sqlite3 libraries by default. Libpcap and libnet are not needed if the
mirroring feature is omitted. Sqlite3 is not needed if the user authentication
feature is omitted. The build depends on GNU make and a POSIX. 2 environment
in PATH. If available, pkg-config is used to locate and configure the
dependencies. The optional unit tests depend on the check library. The
optional end-to-end tests depend on the TestProxy
tool, and are supported only on Linux.
SSLproxy currently supports the following operating systems and NAT mechanisms:
FreeBSD: pf rdr and divert-to, ipfw fwd, ipfilter rdr
OpenBSD: pf rdr-to and divert-to
Linux: netfilter REDIRECT and TPROXY
Mac OS X: pf rdr and ipfw fwd
Support for local process information (-i) is currently available on Mac OS X
and FreeBSD.
SSL/TLS features and compatibility greatly depend on the version of OpenSSL
linked against. For optimal results, use a recent release of OpenSSL or
LibreSSL.
Installation
With the requirements above available, run:
make
make test # optional unit and e2e tests
make sudotest # optional unit tests requiring privileges
make install # optional install
Dependencies are autoconfigured using pkg-config. If dependencies are not
picked up and fixing PKG_CONFIG_PATH does not help, you can specify their
respective locations manually by setting OPENSSL_BASE, LIBEVENT_BASE,
LIBPCAP_BASE, LIBNET_BASE, SQLITE_BASE and/or CHECK_BASE to the
respective prefixes.
You can override the default install prefix (/usr/local) by setting PREFIX.
For more build options and build-time defaults see GNUmakefile
and defaults. h.
Documentation
See the manual pages sslproxy(1) and (5) for user
documentation. See for release notes listing significant
changes between releases and for information on
security vulnerability disclosure.
License
SSLproxy is provided under a 2-clause BSD license.
SSLproxy contains components licensed under the MIT and APSL licenses.
See LICENSE, ntrib and
as well as the respective source file headers
for details.
Credits
See for the list of contributors.
SSLproxy was inspired by and has been developed based on SSLsplit
by Daniel Roethlisberger.
Configuring a Transparent Proxy
A typical configuration example of transparent proxy mode is shown as follows:
Transparent Proxy Example
In this example, the remote client’s address is 172. 16. 0. 99, and it is attempting to connect to
the server at 10. 99, port 80. The front-facing firewall is configured to route
traffic for 10. 99 through the Enterprise Gateway at address 192. 168. 9. The server is
configured to use the Enterprise Gateway at address 10. 1 as its default IP router.
The Enterprise Gateway is multi-homed, and sits on both the 192. 0/24 and 10. 0/24
networks. It is configured with a listening interface at address 10. 99:80,
with transparent proxy mode switched on, as shown in the following Configure HTTP Interface
dialog:
Configure HTTP Interface
The Enterprise Gateway accepts the incoming call from the client, and processes it locally. However, there is no
communication with the server yet. The Enterprise Gateway can process the call to completion and respond to the
client—it is masquerading as the server.
If the Enterprise Gateway invokes a connection filter when processing this call (with transparent proxying enabled),
the connection filter consults the originating address of the client, and binds the local address of the new
outbound connection to that address before connecting. The server then sees the incoming call on the Enterprise Gateway
originating from the client (172. 99), rather than either of the Enterprise Gateway’s IP addresses.
The following dialog shows the example configuration for the Connect to URL filter:
Configure Connection
The result is a transparent proxy, where the client sees itself as connecting directly to the server,
and the server sees an incoming call directly from the client. The Enterprise Gateway processes two separate
TCP connections, one to the client, one to the server, with both masquerading as the other on each
connection.
Note: Either side of the transparent proxy is optional. By configuring the appropriate
settings for the incoming interface or the connection filter, you can masquerade only to the server, or only
to the client.
What is a transparent proxy? Here’s how it works | ExpressVPN Blog
A transparent proxy (also called inline proxy, intercepting proxy, or forced proxy) is a server that sits between your computer and the internet and redirects your requests and responses without modifying them. A proxy server that does modify your requests and responses is defined as a non-transparent proxy. A transparent proxy can be used for various reasons, such as content filtering in schools and libraries, and as it does not need any configuration on the client side, it can be an easy-to-maintain alternative to other proxy ftware like Squid can make it relatively easy to set up a free transparent proxy server that you control. But unlike with other proxy services or VPNs, you do not necessarily need to download an app or program to use a transparent proxy. Instead, it depends on how your network is ternet efficiency through cachingIn places where internet speed is slow, a transparent proxy allows for increased efficiency within the limited bandwidth. It’s especially useful if a large group of people is expected to open the same page, such as the front page of a popular newspaper or a video. The content can be cached by the proxy and served from the cache to the user, instead of having to be downloaded multiple times over a congested ability to censor and monitorTransparent proxies have the ability to selectively censor and monitor your traffic, although internet service providers and network administrators have many other ways to easily do ever, when your connection to a website is encrypted with HTTPS, or you are using a VPN, the proxy is unable to read the data transmitted to and from you. The traffic cannot be monitored, and the proxy loses its ability to cache the content you are cause transparent proxies are created and administered by those already in charge of the network, they are usually not used for circumventing censorship. It is possible however to set up such a proxy to unblock content for users, similar to running a VPN on your Wi-Fi spots use proxies to authenticate usersA transparent proxy can be used to selectively restrict access to the internet. This is commonly used in hotels and public Wi-Fi spots, where users are asked to confirm terms and conditions, enter a phone number, or add other identifying information before they are given access to the internet. Most public Wi-Fi is unencrypted, or perhaps encrypted with outdated technology. And in addition to being monitored by the proxy, the user is at risk of having traffic monitored and intercepted by anybody laptop or phone will usually display a lock next to Wi-Fi networks that offer poorly implemented, the caching and redirection of web traffic can cause problems with Internet connections, particularly when authentication is involved, as a computer might not realize it is not talking directly to a server. A proxy can function both waysA transparent proxy is sometimes not just run on the user side, but also on the servers. This often has the purpose of protecting websites against DDoS attacks, or to increase the capacity of the server, for example when serving large files or videos to many ntent delivery networks use the caching capability of a transparent proxy to serve website content to users more quickly by storing copies of it across the world. When you request a video from a site using such a service, you are likely being served the video from a proxy server near your location, rather than the original is not particularly problematic, although content delivery networks have been criticized for being in a position to potentially spy on the users of their to detect if you are behind a proxyDepending on their configuration, detecting some proxy servers is easy, though others are more hidden and are difficult to spot. A good way to check is to attempt a connection to a server that you know does not exist. Your browser will commonly throw a recognizable error when the connection fails. But if you are behind a proxy this error might be different, or instead you might be redirected to a search sites do allow you to check if you are behind a proxy or not, though with varying more: Big Tech censoring you? Try a distributed social network
Frequently Asked Questions about transparent ssl proxy
How do I make my proxy transparent?
Right-click your service, and select Add Interface -> HTTP or HTTPS to display the appropriate dialog (for example, Configure HTTP Interface). Select the checkbox labeled Transparent Proxy (allow bind to foreign address).
What is a transparent proxy VPN?
A transparent proxy (also called inline proxy, intercepting proxy, or forced proxy) is a server that sits between your computer and the internet and redirects your requests and responses without modifying them. A proxy server that does modify your requests and responses is defined as a non-transparent proxy.Apr 13, 2021
What is direct proxy and transparent proxy?
In a direct proxy configuration, the endpoint client doesn’t need to look up a network address using domain name service (DNS). … In a transparent proxy configuration, DNS lookup is done on the endpoint client, as it is the client machine that connects to the IP address of the web server.
