sonertari / SSLproxy

Transparent SSL/TLS proxy for decrypting and diverting network traffic to other programs, such as UTM services, for deep SSL inspection
BSD 2-Clause "Simplified" License
377 stars 98 forks source link

Inability to send the packet in the format of Ethernet Header + IP Header + TCP Header + ... (Sending just http or https payload and header from SSLproxy) #68

Open IsabellaaaBianchi opened 4 weeks ago

IsabellaaaBianchi commented 4 weeks ago
CACert /etc/web.crt
CAKey /etc/web.key
PidFile /var/run/proxy.pid
ProxySpec {
        Proto https 
        Addr 0.0.0.0 
        Port 45501
        DivertPort 45502
        DivertAddr 127.0.0.1
}

I have a simple Go code running on DivertPort 45502. I am trying to dump incoming requests. However, no matter what I do in the Proto part, I can only dump HTTP payloads. I cannot dump the entire packet(*), which continues as OSI Layer 2, Layer 3, Layer 4, Layer 7. When I set Proto to tcp and open a socket to listen on the relevant port and IP, only the HTTP header + payload can be retrieved.

(*)The packet structure I am referring to consists of a 20-byte Ethernet header, a 20 to 60-byte IP header, and after that a 60-byte TCP header. Could it be that the SSL Proxy is only sending the HTTP header and payload?

sonertari commented 4 weeks ago

That's correct, TCP and SSL connection is established by libevent underneath. So you don't have such control over those details. You can only configure certain SSL parameters, for example using filtering rules.