Archives
/
SSLproxy
mirror of https://github.com/sonertari/SSLproxy
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Rename to sslproxy

Browse Source 
Reduce http headers to just one SSLproxy line
pull/13/head
Soner Tari 7 years ago
parent 4bfc85868b
commit ea6dc07248
9 changed files with 57 additions and 106 deletions
Show Stats Download Patch File Download Diff File

4
.gitignore vendored
Unescape Escape View File

@ -1,7 +1,7 @@
/*.o /*.o
/*.dSYM /*.dSYM
/sslsplit /sslproxy
/sslsplit.test /sslproxy.test
/extra/*.pyc /extra/*.pyc
/extra/pki/dh*.param /extra/pki/dh*.param
/extra/pki/dsa.pem /extra/pki/dsa.pem

2
.travis.yml
Unescape Escape View File

@ -2,7 +2,7 @@ language: c
compiler: compiler:
- gcc - gcc
- clang - clang
script: make && make travis && ./sslsplit -V script: make && make travis && ./sslproxy -V
before_install: before_install:
- sudo apt-get update -qq - sudo apt-get update -qq
- sudo apt-get install -qq libssl-dev libevent-dev check - sudo apt-get install -qq libssl-dev libevent-dev check

3
AUTHORS.md
Unescape Escape View File

@ -25,3 +25,6 @@ See [issue tracker on Github][1], `NEWS.md` and `git log` for details.
All your contributions are greatly appreciated; without you, SSLsplit would not All your contributions are greatly appreciated; without you, SSLsplit would not
be what it is today. be what it is today.
SSLproxy is based on SSLsplit, and has been developed by
[Soner Tari](https://github.com/sonertari).

4
GNUmakefile
Unescape Escape View File

@ -198,8 +198,8 @@ TAR?= tar
### You should not need to touch anything below this line ### You should not need to touch anything below this line
TARGET:= sslsplit TARGET:= sslproxy
PNAME:= SSLsplit PNAME:= SSLproxy
SRCS:= $(filter-out $(wildcard *.t.c),$(wildcard *.c)) SRCS:= $(filter-out $(wildcard *.t.c),$(wildcard *.c))
HDRS:= $(wildcard *.h) HDRS:= $(wildcard *.h)
OBJS:= $(SRCS:.c=.o) OBJS:= $(SRCS:.c=.o)

5
README.md
Unescape Escape View File

@ -1,10 +1,13 @@
# SSLsplit - transparent SSL/TLS interception [![Build Status](https://travis-ci.org/droe/sslsplit.svg?branch=master)](https://travis-ci.org/droe/sslsplit) # SSLsplit - transparent SSL/TLS interception [![Build Status](https://travis-ci.org/droe/sslsplit.svg?branch=master)](https://travis-ci.org/droe/sslsplit)
Copyright (C) 2009-2016, [Daniel Roethlisberger](//daniel.roe.ch/). Copyright (C) 2009-2016, [Daniel Roethlisberger](//daniel.roe.ch/).
http://www.roe.ch/SSLsplit http://www.roe.ch/SSLsplit
The modifications for SSLproxy are copyrighted to [Soner Tari](https://github.com/sonertari),
and licensed under the same license as SSLsplit.
## Overview ## Overview
SSLproxy is based on SSLsplit.
SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encrypted SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encrypted
network connections. It is intended to be useful for network forensics, network connections. It is intended to be useful for network forensics,
application security analysis and penetration testing. application security analysis and penetration testing.

2
extra/sslsplit.sh.in
Unescape Escape View File

@ -1,4 +1,4 @@
#!/bin/sh #!/bin/sh
ulimit -n @@maxfds@@ ulimit -n @@maxfds@@
export LD_LIBRARY_PATH=@@localbase@@/lib:"$LD_LIBRARY_PATH" export LD_LIBRARY_PATH=@@localbase@@/lib:"$LD_LIBRARY_PATH"
exec @@prefix@@/bin/sslsplit "$@" exec @@prefix@@/bin/sslproxy "$@"

6
main.c
Unescape Escape View File

@ -85,7 +85,7 @@ main_version(void)
fprintf(stderr, "---------------------------------------" fprintf(stderr, "---------------------------------------"
"---------------------------------------\n"); "---------------------------------------\n");
fprintf(stderr, "WARNING: Something is wrong with the " fprintf(stderr, "WARNING: Something is wrong with the "
"version compiled into sslsplit!\n"); "version compiled into sslproxy!\n");
fprintf(stderr, "The version should contain a release " fprintf(stderr, "The version should contain a release "
"number and/or a git commit reference.\n"); "number and/or a git commit reference.\n");
fprintf(stderr, "If using a package, please report a bug " fprintf(stderr, "If using a package, please report a bug "
@ -190,11 +190,11 @@ main_usage(void)
#endif /* HAVE_LOCAL_PROCINFO */ #endif /* HAVE_LOCAL_PROCINFO */
" %%%% - literal '%%'\n" " %%%% - literal '%%'\n"
#ifdef HAVE_LOCAL_PROCINFO #ifdef HAVE_LOCAL_PROCINFO
" e.g. \"/var/log/sslsplit/%%X/%%u-%%s-%%d-%%T.log\"\n" " e.g. \"/var/log/sslproxy/%%X/%%u-%%s-%%d-%%T.log\"\n"
" -i look up local process owning each connection for logging\n" " -i look up local process owning each connection for logging\n"
#define OPT_i "i" #define OPT_i "i"
#else /* !HAVE_LOCAL_PROCINFO */ #else /* !HAVE_LOCAL_PROCINFO */
" e.g. \"/var/log/sslsplit/%%T-%%s-%%d.log\"\n" " e.g. \"/var/log/sslproxy/%%T-%%s-%%d.log\"\n"
#define OPT_i #define OPT_i
#endif /* HAVE_LOCAL_PROCINFO */ #endif /* HAVE_LOCAL_PROCINFO */
" -d daemon mode: run in background, log error messages to syslog\n" " -d daemon mode: run in background, log error messages to syslog\n"

129
pxyconn.c
Unescape Escape View File

@ -110,12 +110,8 @@ typedef struct pxy_conn_lproc_desc {
#define WANT_CONNECT_LOG(ctx) ((ctx)->opts->connectlog||!(ctx)->opts->detach) #define WANT_CONNECT_LOG(ctx) ((ctx)->opts->connectlog||!(ctx)->opts->detach)
#define WANT_CONTENT_LOG(ctx) ((ctx)->opts->contentlog&&!(ctx)->passthrough) #define WANT_CONTENT_LOG(ctx) ((ctx)->opts->contentlog&&!(ctx)->passthrough)
#define SSLPROXY_ADDR_KEY "SSLproxy-Addr:" #define SSLPROXY_KEY "SSLproxy:"
#define SSLPROXY_ADDR_KEY_LEN strlen(SSLPROXY_ADDR_KEY) #define SSLPROXY_KEY_LEN strlen(SSLPROXY_KEY)
#define SSLPROXY_SRCADDR_KEY "SSLproxy-SrcAddr:"
#define SSLPROXY_SRCADDR_KEY_LEN strlen(SSLPROXY_SRCADDR_KEY)
#define SSLPROXY_DSTADDR_KEY "SSLproxy-DstAddr:"
#define SSLPROXY_DSTADDR_KEY_LEN strlen(SSLPROXY_DSTADDR_KEY)
static pxy_conn_ctx_t * MALLOC NONNULL(2,3,4) static pxy_conn_ctx_t * MALLOC NONNULL(2,3,4)
pxy_conn_ctx_new(evutil_socket_t fd, pxy_conn_ctx_new(evutil_socket_t fd,
@ -433,14 +429,8 @@ pxy_conn_ctx_free(pxy_conn_ctx_t *ctx, int by_requestor)
if (ctx->sni) { if (ctx->sni) {
free(ctx->sni); free(ctx->sni);
} }
if (ctx->child_addr_str) { if (ctx->header_str) {
free(ctx->child_addr_str); free(ctx->header_str);
}
if (ctx->src_addr_str) {
free(ctx->src_addr_str);
}
if (ctx->dst_addr_str) {
free(ctx->dst_addr_str);
} }
if (ctx->srv_dst_ssl_version) { if (ctx->srv_dst_ssl_version) {
free(ctx->srv_dst_ssl_version); free(ctx->srv_dst_ssl_version);
@ -1506,9 +1496,7 @@ pxy_http_reqhdr_filter_line(const char *line, pxy_conn_ctx_t *ctx, int child)
} else if (!strncasecmp(line, "Accept-Encoding:", 16) || } else if (!strncasecmp(line, "Accept-Encoding:", 16) ||
!strncasecmp(line, "Keep-Alive:", 11)) { !strncasecmp(line, "Keep-Alive:", 11)) {
return NULL; return NULL;
} else if (child && (!strncasecmp(line, SSLPROXY_ADDR_KEY, SSLPROXY_ADDR_KEY_LEN) || } else if (child && (!strncasecmp(line, SSLPROXY_KEY, SSLPROXY_KEY_LEN) ||
!strncasecmp(line, SSLPROXY_SRCADDR_KEY, SSLPROXY_SRCADDR_KEY_LEN) ||
!strncasecmp(line, SSLPROXY_DSTADDR_KEY, SSLPROXY_DSTADDR_KEY_LEN) ||
// @attention flickr keeps redirecting to https with 301 unless we remove the Via line of squid // @attention flickr keeps redirecting to https with 301 unless we remove the Via line of squid
// Apparently flickr assumes the existence of Via header field or squid keyword a sign of plain http, even if we are using https // Apparently flickr assumes the existence of Via header field or squid keyword a sign of plain http, even if we are using https
!strncasecmp(line, "Via:", 4) || !strncasecmp(line, "Via:", 4) ||
@ -1846,7 +1834,7 @@ static void
pxy_http_reqhdr_filter(struct evbuffer *inbuf, struct evbuffer *outbuf, struct bufferevent *bev, pxy_conn_ctx_t *ctx, pxy_conn_ctx_t *parent, int child) pxy_http_reqhdr_filter(struct evbuffer *inbuf, struct evbuffer *outbuf, struct bufferevent *bev, pxy_conn_ctx_t *ctx, pxy_conn_ctx_t *parent, int child)
{ {
logbuf_t *lb = NULL, *tail = NULL; logbuf_t *lb = NULL, *tail = NULL;
int inserted_sslproxy_addr = 0; int inserted_header = 0;
char *line; char *line;
while ((line = evbuffer_readln(inbuf, NULL, EVBUFFER_EOL_CRLF))) { while ((line = evbuffer_readln(inbuf, NULL, EVBUFFER_EOL_CRLF))) {
char *replace; char *replace;
@ -1876,12 +1864,10 @@ pxy_http_reqhdr_filter(struct evbuffer *inbuf, struct evbuffer *outbuf, struct b
} }
free(line); free(line);
if (!child && !inserted_sslproxy_addr) { if (!child && !inserted_header) {
inserted_sslproxy_addr = 1; inserted_header = 1;
log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>> pxy_http_reqhdr_filter: src INSERT sslproxy_addr line, fd=%d: %s\n", ctx->fd, ctx->child_addr_str); log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>> pxy_http_reqhdr_filter: src INSERT header_str line, fd=%d: %s\n", ctx->fd, ctx->header_str);
evbuffer_add_printf(outbuf, "%s\r\n", ctx->child_addr_str); evbuffer_add_printf(outbuf, "%s\r\n", ctx->header_str);
log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>> pxy_http_reqhdr_filter: src INSERT sslproxy_srcaddr line, fd=%d: %s\n", ctx->fd, ctx->src_addr_str);
evbuffer_add_printf(outbuf, "%s\r\n", ctx->src_addr_str);
} }
if (ctx->seen_req_header) { if (ctx->seen_req_header) {
@ -2113,14 +2099,12 @@ pxy_bev_readcb(struct bufferevent *bev, void *arg)
goto leave; goto leave;
} }
} else { } else {
log_dbg_level_printf(LOG_DBG_MODE_FINER, ">>>>>,,,,,,,,,,,,,,,,,,,,,,, pxy_bev_readcb: custom_field= %s\n", ctx->child_addr_str); log_dbg_level_printf(LOG_DBG_MODE_FINER, ">>>>>,,,,,,,,,,,,,,,,,,,,,,, pxy_bev_readcb: SSLproxy header= %s\n", ctx->header_str);
size_t child_addr_len = strlen(ctx->child_addr_str); size_t header_len = strlen(ctx->header_str);
size_t src_addr_len = strlen(ctx->src_addr_str);
size_t dst_addr_len = strlen(ctx->dst_addr_str);
size_t packet_size = evbuffer_get_length(inbuf); size_t packet_size = evbuffer_get_length(inbuf);
// +2 is for \r\n // +2 is for \r\n
char *packet = malloc(packet_size + child_addr_len + 2 + src_addr_len + 2 + dst_addr_len + 2); char *packet = malloc(packet_size + header_len + 2);
if (!packet) { if (!packet) {
// @todo Should we just set enomem? // @todo Should we just set enomem?
ctx->enomem = 1; ctx->enomem = 1;
@ -2144,26 +2128,21 @@ pxy_bev_readcb(struct bufferevent *bev, void *arg)
// And we are dealing pop3 and smtp also, not just http. // And we are dealing pop3 and smtp also, not just http.
// @attention Cannot use string manipulation functions; we are dealing with binary arrays here, not NULL-terminated strings // @attention Cannot use string manipulation functions; we are dealing with binary arrays here, not NULL-terminated strings
if (!ctx->sent_addr_info) { if (!ctx->sent_header) {
if (ctx->spec->mail) { if (ctx->spec->mail) {
memmove(packet + child_addr_len + 2 + src_addr_len + 2 + dst_addr_len + 2, packet, packet_size); memmove(packet + header_len + 2, packet, packet_size);
memcpy(packet, ctx->child_addr_str, child_addr_len); memcpy(packet, ctx->header_str, header_len);
memcpy(packet + child_addr_len, "\r\n", 2); memcpy(packet + header_len, "\r\n", 2);
memcpy(packet + child_addr_len + 2, ctx->src_addr_str, src_addr_len); packet_size+= header_len + 2;
memcpy(packet + child_addr_len + 2 + src_addr_len, "\r\n", 2); ctx->sent_header = 1;
memcpy(packet + child_addr_len + 2 + src_addr_len + 2, ctx->dst_addr_str, src_addr_len);
memcpy(packet + child_addr_len + 2 + src_addr_len + 2 + dst_addr_len, "\r\n", 2);
packet_size+= child_addr_len + 2 + src_addr_len + 2 + dst_addr_len + 2;
ctx->sent_addr_info = 1;
} else { } else {
char *pos = memmem(packet, packet_size, "\r\n", 2); char *pos = memmem(packet, packet_size, "\r\n", 2);
if (pos) { if (pos) {
memmove(pos + 2 + child_addr_len + 2 + src_addr_len, pos, packet_size - (pos - packet)); memmove(pos + 2 + header_len, pos, packet_size - (pos - packet));
memcpy(pos + 2, ctx->child_addr_str, child_addr_len); memcpy(pos + 2, ctx->header_str, header_len);
memcpy(pos + 2 + child_addr_len, "\r\n", 2); memcpy(pos + 2 + header_len, "\r\n", 2);
memcpy(pos + 2 + child_addr_len + 2, ctx->src_addr_str, src_addr_len); packet_size+= header_len + 2;
packet_size+= child_addr_len + 2 + src_addr_len + 2; ctx->sent_header = 1;
ctx->sent_addr_info = 1;
} else { } else {
log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>>,,,,,,,,,,,,,,,,,,,,,,, pxy_bev_readcb: No CRLF in packet\n"); log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>>,,,,,,,,,,,,,,,,,,,,,,, pxy_bev_readcb: No CRLF in packet\n");
} }
@ -2298,30 +2277,12 @@ pxy_bev_readcb_child(struct bufferevent *bev, void *arg)
log_err_printf("ERROR: evbuffer_remove cannot drain the buffer\n"); log_err_printf("ERROR: evbuffer_remove cannot drain the buffer\n");
} }
size_t child_addr_len = strlen(parent->child_addr_str); size_t header_len = strlen(parent->header_str);
char *pos = memmem(packet, packet_size, parent->child_addr_str, child_addr_len); char *pos = memmem(packet, packet_size, parent->header_str, header_len);
if (pos) {
memmove(pos, pos + child_addr_len + 2, packet_size - (pos - packet) - (child_addr_len + 2));
packet_size-= child_addr_len + 2;
log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>>....................... pxy_bev_readcb_child: <<<<<<<<<<<<<<<<<<<<<<<<<<<<< REMOVED SSLproxy-Addr\n");
}
// @todo Combine src_addr removal with child_addr removal?
size_t src_addr_len = strlen(parent->src_addr_str);
pos = memmem(packet, packet_size, parent->src_addr_str, src_addr_len);
if (pos) {
memmove(pos, pos + src_addr_len + 2, packet_size - (pos - packet) - (src_addr_len + 2));
packet_size-= src_addr_len + 2;
log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>>....................... pxy_bev_readcb_child: <<<<<<<<<<<<<<<<<<<<<<<<<<<<< REMOVED SSLproxy-SrcAddr\n");
}
// @todo Combine dst_addr removal with src_addr removal?
size_t dst_addr_len = strlen(parent->dst_addr_str);
pos = memmem(packet, packet_size, parent->dst_addr_str, dst_addr_len);
if (pos) { if (pos) {
memmove(pos, pos + dst_addr_len + 2, packet_size - (pos - packet) - (dst_addr_len + 2)); memmove(pos, pos + header_len + 2, packet_size - (pos - packet) - (header_len + 2));
packet_size-= dst_addr_len + 2; packet_size-= header_len + 2;
log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>>....................... pxy_bev_readcb_child: <<<<<<<<<<<<<<<<<<<<<<<<<<<<< REMOVED SSLproxy-DstAddr\n"); log_dbg_level_printf(LOG_DBG_MODE_FINEST, ">>>>>....................... pxy_bev_readcb_child: <<<<<<<<<<<<<<<<<<<<<<<<<<<<< REMOVED SSLproxy header\n");
} }
if (evbuffer_add(outbuf, packet, packet_size) < 0) { if (evbuffer_add(outbuf, packet, packet_size) < 0) {
@ -2743,35 +2704,21 @@ pxy_connected_enable(struct bufferevent *bev, pxy_conn_ctx_t *ctx, char *event_n
return 0; return 0;
} }
// SSLproxy: [127.0.0.1]:34649,[192.168.3.24]:47286,[74.125.206.108]:465,s
// @todo Port may be less than 5 chars // @todo Port may be less than 5 chars
int addr_len = SSLPROXY_ADDR_KEY_LEN + 1 + strlen(addr) + 5 + 3 + 1; // SSLproxy: + + [ + addr + ] + : + p + , + [ + srchost_str + ] + : + srcport_str + , + [ + dsthost_str + ] + : + dstport_str + , + s + NULL
// SSLPROXY_KEY_LEN + 1 + 1 + strlen(addr) + 1 + 1 + 5 + 1 + 1 + strlen(ctx->srchost_str) + 1 + 1 + strlen(ctx->srcport_str) + 1 + 1 + strlen(ctx->dsthost_str) + 1 + 1 + strlen(ctx->dstport_str) + 1 + 1 + 1
int header_len = SSLPROXY_KEY_LEN + strlen(addr) + strlen(ctx->srchost_str) + strlen(ctx->srcport_str) + strlen(ctx->dsthost_str) + strlen(ctx->dstport_str) + 20;
// @todo Always check malloc retvals. Should we close the conn if malloc fails? // @todo Always check malloc retvals. Should we close the conn if malloc fails?
ctx->child_addr_str = malloc(addr_len); ctx->header_str = malloc(header_len);
if (!ctx->child_addr_str) { if (!ctx->header_str) {
pxy_conn_free(ctx, 1);
return 0;
}
snprintf(ctx->child_addr_str, addr_len, "%s [%s]:%u", SSLPROXY_ADDR_KEY, addr, ntohs(child_listener_addr.sin_port));
// SSLproxy-SrcAddr: [192.168.3.23]:49260,s
int src_addr_len = SSLPROXY_SRCADDR_KEY_LEN + 2 + strlen(ctx->srchost_str) + 2 + strlen(ctx->srcport_str) + 1 + 1 + 1;
ctx->src_addr_str = malloc(src_addr_len);
if (!ctx->src_addr_str) {
pxy_conn_free(ctx, 1);
return 0;
}
snprintf(ctx->src_addr_str, src_addr_len, "%s [%s]:%s,%s", SSLPROXY_SRCADDR_KEY, ctx->srchost_str, ctx->srcport_str, ctx->spec->ssl ? "s":"p");
// SSLproxy-DstAddr: [192.168.3.23]:49260,s
int dst_addr_len = SSLPROXY_DSTADDR_KEY_LEN + 2 + strlen(ctx->dsthost_str) + 2 + strlen(ctx->dstport_str) + 1 + 1 + 1;
ctx->dst_addr_str = malloc(dst_addr_len);
if (!ctx->dst_addr_str) {
pxy_conn_free(ctx, 1); pxy_conn_free(ctx, 1);
return 0; return 0;
} }
snprintf(ctx->dst_addr_str, dst_addr_len, "%s [%s]:%s,%s", SSLPROXY_DSTADDR_KEY, ctx->dsthost_str, ctx->dstport_str, ctx->spec->ssl ? "s":"p"); snprintf(ctx->header_str, header_len, "%s [%s]:%u,[%s]:%s,[%s]:%s,%s",
SSLPROXY_KEY, addr, ntohs(child_listener_addr.sin_port), ctx->srchost_str, ctx->srcport_str, ctx->dsthost_str, ctx->dstport_str, ctx->spec->ssl ? "s":"p");
log_dbg_level_printf(LOG_DBG_MODE_FINER, ">>>>>=================================== pxy_connected_enable: ENABLE src, child_addr= %s, fd=%d, child_fd=%d\n", ctx->child_addr_str, fd, ctx->child_fd); log_dbg_level_printf(LOG_DBG_MODE_FINER, ">>>>>=================================== pxy_connected_enable: ENABLE src, SSLproxy header= %s, fd=%d, child_fd=%d\n", ctx->header_str, fd, ctx->child_fd);
// Now open the gates // Now open the gates
bufferevent_enable(ctx->src.bev, EV_READ|EV_WRITE); bufferevent_enable(ctx->src.bev, EV_READ|EV_WRITE);

8
pxyconn.h
Unescape Escape View File

@ -142,11 +142,9 @@ struct pxy_conn_ctx {
// Fd of the listener event for the children // Fd of the listener event for the children
evutil_socket_t child_fd; evutil_socket_t child_fd;
struct evconnlistener *child_evcl; struct evconnlistener *child_evcl;
// SSL proxy return address: The IP:port address the children are listening to // SSL proxy return address: The IP:port address the children are listening to, orig client addr, and orig target addr
char *child_addr_str; char *header_str;
char *src_addr_str; int sent_header;
char *dst_addr_str;
int sent_addr_info;
// Child list of the conn // Child list of the conn
pxy_conn_child_ctx_t *children; pxy_conn_child_ctx_t *children;

Write Preview
Loading…
Cancel
Save