search

droe / sslsplit

Transparent SSL/TLS interception
https://www.roe.ch/SSLsplit
BSD 2-Clause "Simplified" License
1.75k stars 328 forks source link

Error 24 on listener #31

Closed noiala closed 9 years ago

noiala commented 9 years ago

Sslsplit installed just fine and also starts without any issue. When I hit enter on the client browser it goes: .... .... Connecting to [192.168.1.10]:8080 Connecting to [192.168.1.10]:8080 Error 24 on listener: Too many open files Main event loop stopped. Error from bufferevent: 104:Connection reset by peer 0:0:-:0:-:0:- Segmentation fault (core dumped)

The "connecting to IP" line repeats several times.

sslsplit -V: SSLsplit 0.4.8-10-g85b177f (built 2014-10-01) Copyright (c) 2009-2014, Daniel Roethlisberger daniel@roe.ch http://www.roe.ch/SSLsplit Features: -DDISABLE_SSLV2_SESSION_CACHE -DHAVE_NETFILTER NAT engines: netfilter* tproxy netfilter: IP_TRANSPARENT SOL_IPV6 !IPV6_ORIGINAL_DST compiled against OpenSSL 1.0.1f 6 Jan 2014 (1000106f) rtlinked against OpenSSL 1.0.1f 6 Jan 2014 (1000106f) TLS Server Name Indication (SNI) supported OpenSSL is thread-safe with THREADID Using SSL_MODE_RELEASE_BUFFERS SSL/TLS algorithm availability: RSA DSA ECDSA DH ECDH EC OpenSSL option availability: SSL_OP_NO_COMPRESSION SSL_OP_NO_TICKET SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION SSL_OP_TLS_ROLLBACK_BUG compiled against libevent 2.0.21-stable rtlinked against libevent 2.0.21-stable 2 CPU cores detected

Not sure what I'm doing wrong here.

Thx.

noiala commented 9 years ago

I see #23 now, but I'm still not sure how to setup iptables/netfilter to get this working.

droe commented 9 years ago

Well, you need to tell your kernel not to interfer with connections originating from sslsplit locally, otherwise that creates an endless loop of connections. As outlined in #23, there are many ways to do that, depending on your setup. Try limiting the redirection rules to the network interface that the connections are coming in on, for an easy solution. In case you are trying to run sslsplit on the same system as the browser, on Linux Netfilter you can solve that by running sslsplit under a different account than the browser and then using the owner module to only apply the redirection rules to the user the browser runs as. If you have a working iptables config for running it locally, feel free to submit a patch to the manual page or post it here to share it, that might be useful for others.

Not a bug, closing the issue.

arinc9 commented 2 years ago

Looking at this issue years later, using owner module to differentiate the traffic makes sense. Maybe marking the sslsplit traffic could be another solution? Adding an option to set a fwmark on sslsplit traffic so the marked traffic won't be caught by the REDIRECT rule we put.

For anyone looking for an easy way out: Run sslsplit as root.

iptables -t nat -A OUTPUT -d <attackedIP> -p tcp -m owner --gid-owner <yourUserName> --dport 443 -j REDIRECT --to-ports 8443