search

Lochnair / xt_tls

Filter TLS traffic with IPtables
GNU General Public License v3.0
230 stars 46 forks source link

Block TLS packets without SNI extension #61

Open bgcorreia opened 1 year ago

bgcorreia commented 1 year ago

Hi everyone, today I need to block https requests that use IP address directly (i.e. https://1.2.3.4, without a host header), I was reviewing the TLS header and I saw these packets don't have the SNI extension, so my doubt is: can I use xt_tls module for block packets without SNI extension in tls header? Thanks so much!!

bgcorreia commented 1 year ago

I know that maybe is not the better solution (I didn't add control parameters and etc), but I did a change for attend the commented needs (block an TLS Client Hello without a server_name extension). The commit is here: https://github.com/bgcorreia/xt_tls/commit/b456f9fe316526d6b8f45c3bc82da96fc1b5e85d

juliaisnotavailable commented 7 months ago

I would also be intrested in the reverse of this. i.e. A filter that drops packets if any SNI value is present. (in order to effectivly enforce ECH/ESNI)

bgcorreia commented 7 months ago

@juliaisnotavailable you could use the commit that I leaved.

Look this line, there I added a flag variable to identify when the request has a sni extension, and after I used this one to "block it" (with if and return line here).

So, to reach the behavior that you can, you just need to change on line 237 from if (!has_sni_extension) to if (has_sni_extension).