search

net4people / bbs

Forum for discussing Internet censorship circumvention
3.4k stars 80 forks source link

Is it possible to proxy Http/2 to Http/3 on TCP layer? #406

Open louiesun opened 1 day ago

louiesun commented 1 day ago

I want to write a proxy but I don't want to add a CA on my users's computer.

So I can't decrypt the flow.

Is it possible?

wkrp commented 1 day ago

No, it's not possible. If it were possible for a local proxy to decrypt TLS and re-encrypt as QUIC, it would be possible for anyone on the network path to do it, which would mean TLS is insecure.

There's a thread about local CA and MITM at #373.

You could, of course, wrap HTTP/2 (or any other stream) in an HTTP/3 tunnel, using a local HTTP proxy (CONNECT) or MASQUE CONNECT-UDP or CONNECT-IP. But then you can't forward connections straight to the origin web server, you need a proxy server to remove the outer layer.

louiesun commented 1 day ago

No, it's not possible. If it were possible for a local proxy to decrypt TLS and re-encrypt as QUIC, it would be possible for anyone on the network path to do it, which would mean TLS is insecure.

There's a thread about local CA and MITM at #373.

You could, of course, wrap HTTP/2 (or any other stream) in an HTTP/3 tunnel, using a local HTTP proxy (CONNECT) or MASQUE CONNECT-UDP or CONNECT-IP. But then you can't forward connections straight to the origin web server, you need a proxy server to remove the outer layer.

I don't want to decrypt the package. I am trying to move the randoms and secrets and some other things of the packages. Can we just move the clinet random from one to another and move the encrypted server responce from another to one?

mmmray commented 1 day ago

the payload inside TLS in h2 vs h3 looks completely different, and has to be converted. you can't do it for the same reason you can't convert h1 to h2 without decrypting. of course, with QUIC there are more issues than that.