search

securesocketfunneling / ssf

Secure Socket Funneling - Network tool and toolkit - TCP and UDP port forwarding, SOCKS proxy, remote shell, standalone and cross platform
https://securesocketfunneling.github.io/ssf/
Other
1.56k stars 231 forks source link

[Request] How to recognize ssf protocol? #109

Open colemar opened 1 month ago

colemar commented 1 month ago

I need to identify the ssf protocol in order to let sslh (protocol demultiplexer by Yves Rutschle) recognize it and distinguish an ssf client connection on port 1234 from the others. If sslh recognizes an ssf client it should forward the tcp connection to localhost:8011.

Emulating the server with the command ncat -lk 1234 | xxd I can see that when an ssf (Windows) client attempts a connection the first 11 bytes sent are always: \x16\x03\x01\x00\x5a\x01\x00\x00\x56\x03\x03

Is this a reliable check?

colemar commented 1 month ago

After some consideration, I realized that the above mentioned 11 bytes are part of the TLS handshake, therefore they are not specific to an ssf client.

I plan now to make the ssf client connect through an existing remote stunnel4 on port 443, which already provides a secure TLS channel. Can ssf be configured to handshake with a remote stunnel4 daemon which already uses a "Let’s Encrypt" certificate? Cann ssfd be configured to drop the TLS layer?