search

adamfisk / LittleProxy

High performance HTTP proxy originally written by your friends at Lantern and now maintained by a stellar group of volunteer open source programmers.
https://www.getlantern.org
Apache License 2.0
2.06k stars 778 forks source link

decoderResult failure when using iptables with transparent proxy enabled. #372

Open VanitySoft opened 7 years ago

VanitySoft commented 7 years ago

I have littleproxy with MITM(Impersonating) working perfectly. below works nicely. wget https://facebook.com --ca-cert=/home/jeryl/generated-ca.cer -e use_proxy=on -e https_proxy=http://10.1.1.1:8444

I now want to transparently configure my box to use the proxy on all outbound requests over 443. my proxy is running on a separate unix 'box1' on our network 10.1.1.1 on port 8444 so I updated my iptables rules on the 'box2' where users make calls. iptables -t nat -A OUTPUT -p tcp -o -lo --dport 443 -DNAT --to 10.1.1.1:8444

performing wget https://facebook.com --ca-cert=/home/jeryl/generated-ca.cer should forward requests to the proxy server(8444) on box1.

HOWEVER, it does not seem httpRequest are being decoded. i get the error: decoderResults=falure.. because the content is empty.?? shouldn't littleproxy be able to decode this? is this a bug?

it looks like this is not working and provide simular functionality as Suid SSL-Bumping: https://www.mydlp.com/how-to-configure-squid-3-2-ssl-bumping-dynamic-ssl-certificate-generation/

albertok commented 7 years ago

LittleProxy does not currently support transparent mode, it can only be an explicit proxy.