SSL Proxy List | HTTPS Proxy List – Free Proxy List
SSL Proxy List | HTTPS Proxy List – Free Proxy ListSSL (HTTPS) proxies that are just checked and updated every 10 minutesIP AddressPortCodeCountryAnonymityGoogleHttpsLast Checked64. 124. 38. 1398080USUnited Stateselite proxynoyes1 sec ago158. 177. 253. 2480USUnited Statesanonymousnoyes1 sec ago14. 241. 120. 10055443VNVietnamelite proxynoyes1 sec ago104. 211. 1. 19749205USUnited Stateselite proxynoyes1 sec ago169. 57. 848123MXMexicoelite proxynoyes1 sec ago91. 107. 6. 11553281RURussian Federationelite proxynoyes2 mins ago45. 64. 122. 21047552PHPhilippineselite proxynoyes2 mins ago197. 245. 230. 12241026ZASouth Africaelite proxynoyes2 mins ago36. 67. 4530066IDIndonesiaelite proxynoyes2 mins ago36. 95. 23. 898080IDIndonesiaelite proxynoyes2 mins ago89. 250. 221. 10653281RURussian Federationelite proxynoyes2 mins ago103. 240. 77. 9830093INIndiaelite proxynoyes2 mins ago3. 82. 162. 16149205USUnited Stateselite proxynoyes2 mins ago138. 0. 3080BRBrazilelite proxynoyes2 mins ago200. 29. 109. 11244749COColombiaelite proxynoyes2 mins ago3. 84. 148. 14249205USUnited Stateselite proxynoyes2 mins ago69. 63. 73. 17153281SZSwazilandelite proxynoyes2 mins ago185. 119. 117. 1588000ATAustriaanonymousnoyes2 mins ago68. 183. 93. 2283128INIndiaanonymousyesyes2 mins ago170. 81. 35. 2636681CRCosta Ricaelite proxynoyes2 mins ago41. 60. 236. 18761031KEKenyaelite proxynoyes2 mins ago109. 188. 74. 958080RURussian Federationelite proxynoyes2 mins ago34. 207. 166. 23449205USUnited Stateselite proxynoyes2 mins ago91. 988080GRGreeceanonymousnoyes2 mins ago177. 125. 169. 655443BRBrazilelite proxynoyes2 mins ago43. 225. 66. 18580IDIndonesiaelite proxynoyes2 mins ago203. 176. 180. 15455443IDIndonesiaelite proxynoyes2 mins ago111. 92. 13430598KHCambodiaelite proxynoyes2 mins ago203. 194. 111. 1126969INIndiaelite proxynoyes2 mins ago136. 228. 141. 15480KHCambodiaanonymousyesyes2 mins ago150. 129. 171. 3530093INIndiaelite proxynoyes2 mins ago103. 205. 1855443BDBangladeshelite proxynoyes2 mins ago177. 10. 193. 2338080BRBrazilanonymousnoyes2 mins ago91. 144. 11855443BGBulgariaelite proxynoyes2 mins ago187. 99. 463128BRBrazilelite proxynoyes2 mins ago47. 191. 1028080HKHong Kongelite proxynoyes2 mins ago41. 13. 18653281MWMalawielite proxynoyes2 mins ago125. 17. 248. 508080INIndiaelite proxynoyes2 mins ago62. 168. 61. 2413128CZCzech Republicanonymousnoyes2 mins ago164. 68. 123. 1199300DEGermanyelite proxynoyes2 mins ago54. 134. 220096USUnited Stateselite proxynoyes11 mins ago31. 220. 21753281RURussian Federationelite proxynoyes11 mins ago222. 252. 156. 6162694VNVietnamelite proxynoyes11 mins ago20. 199. 116. 18449205FRFranceelite proxynoyes11 mins ago116. 251. 216. 9580SGSingaporeelite proxynoyes11 mins ago27. 51. 856666INIndiaelite proxynoyes11 mins ago182. 149. 6622800PKPakistanelite proxynoyes11 mins ago116. 206. 62. 24457433BDBangladeshelite proxynoyes11 mins ago34. 239. 226. 12249205USUnited Stateselite proxynoyes11 mins ago196. 15. 213. 2353128ZASouth Africaelite proxynoyes11 mins ago105. 27. 2536969UGUgandaelite proxynoyes11 mins ago54. 90. 9. 6549205USUnited Stateselite proxynoyes11 mins ago23. 2132180USUnited Stateselite proxynoyes13 mins ago203. 190. 118. 228071IDIndonesiaelite proxynoyes13 mins ago52. 170. 159. 12649205USUnited Stateselite proxynoyes13 mins ago59. 153. 83. 17055667IDIndonesiaelite proxynoyes13 mins ago78. 154. 167. 688080UAUkraineelite proxynoyes14 mins ago180. 21059778IDIndonesiaelite proxynoyes14 mins ago117. 102. 653281IDIndonesiaelite proxynoyes14 mins ago62. 33. 210. 3458918RURussian Federationelite proxynoyes14 mins ago222. 165. 6758687IDIndonesiaelite proxynoyes14 mins ago50. 246. 1258080USUnited Stateselite proxynoyes14 mins ago182. 79. 16239902IDIndonesiaelite proxynoyes14 mins ago112. 78. 278080IDIndonesiaelite proxynoyes14 mins ago170. 4. 22237409ARArgentinaelite proxynoyes14 mins ago110. 232. 4355443IDIndonesiaelite proxynoyes14 mins ago216. 6534679USUnited Stateselite proxynoyes14 mins ago94. 12455443RURussian Federationelite proxynoyes14 mins ago62. 7453281RURussian Federationelite proxynoyes14 mins ago40. 87. 6549205USUnited Stateselite proxynoyes14 mins ago40. 136. 22649205USUnited Stateselite proxynoyes14 mins ago20. 113. 3249205FRFranceelite proxynoyes14 mins ago52. 39. 21649205USUnited Stateselite proxynoyes14 mins ago191. 5. 7953281BRBrazilelite proxynoyes14 mins ago93. 157. 163. 6635081RURussian Federationelite proxynoyes14 mins ago18. 223. 97. 11349205USUnited Stateselite proxynoyes14 mins ago3. 152. 3549205USUnited Stateselite proxynoyes14 mins ago54. 173. 104. 7249205USUnited Stateselite proxynoyes14 mins ago18. 212. 4749205USUnited Stateselite proxynoyes14 mins ago34. 89. 15149205USUnited Stateselite proxynoyes14 mins ago100. 26. 189. 10149205USUnited Stateselite proxynoyes14 mins ago40. 121. 22849205USUnited Stateselite proxynoyes14 mins ago54. 235. 6149205USUnited Stateselite proxynoyes14 mins ago177. 13455443BRBrazilelite proxynoyes14 mins ago3. 231. 222. 9749205USUnited Stateselite proxynoyes14 mins ago150. 9935101INIndiaelite proxynoyes14 mins ago3. 10349205USUnited Stateselite proxynoyes14 mins ago20. 21849205FRFranceelite proxynoyes14 mins ago3. 17149205USUnited Stateselite proxynoyes14 mins ago20. 2649205FRFranceelite proxynoyes14 mins ago40. 128. 4349205FRFranceelite proxynoyes14 mins ago103. 903128IDIndonesiaelite proxynoyes14 mins ago137. 135. 11949205IEIrelandelite proxynoyes14 mins ago103. 31. 979090IDIndonesiaanonymousnoyes14 mins ago3. 88. 16949205USUnited Stateselite proxynoyes14 mins ago54. 19. 25049205USUnited Stateselite proxynoyes14 mins ago20. 5649205FRFranceelite proxynoyes14 mins ago52. 143. 4649205FRFranceelite proxynoyes14 mins ago103. 69. 45. 22958538INIndiaelite proxynoyes14 mins ago20. 195. 11949205BRBrazilelite proxynoyes14 mins agoPremium ProxyUse our premium proxy services to hide your real IP addressMy IP HideSurf with 101 encrypted proxies in 34 countries. Change IP every minute. Faster than Product Rotating Proxy8152 HTTP(s)/Socks5 proxies for SEO/traffic tools. Rotate IP every second or 30 more Socks Proxy List3940 Socks5/4 proxies for SEO/traffic tools (ex. scrapers and bots). Get them by API URL or more Rotating ProxyStable HTTP(s)/Socks Proxy with 8152 Auto-Rotating IPs in 743 SubnetsUse it just like a regular HTTP(s)/Socks proxy, without any app. However, it has 8152 stable IPs (1085 Google proxies) behind and supports IP/Pass auth and country filter. • Fast Rotating Port: Rotate IP for every request on the port 2000 (HTTP/s) or 3000 (Socks5/4). • Slow Rotating Ports: Rotate IP every 30 minutes on the ports 20001~20500 or it worksGateway proxy redirects requests to new IPs in the proxy pool, then to the targetGuideHow to use our rotating proxy with your software? UsageUse it in fast rotating mode, slow rotating mode, or bothSlow Rotating ModeThe real IPs behind the slow rotating ports change every 30 mins. If you want to change IP at once, just use a new Rotating ModeRotate IP for every request. You can use it in traffic software or scraping scripts. Here is a quick Rotating Proxy 15-day money-back guaranteePricing15-day money-back guarantee. Cancel at any nthlyYearly 2 Months FreeRotating Pro 5MHigh Speed (5X) 100 Threads Unmetered Traffic 8152 Premium IPs HTTP(s) & Socks5/4 5 Whitelist IPs Rotating Pro 2MMedium Speed (2X) 40 Threads Unmetered Traffic 8152 Premium IPs HTTP(s) & Socks5/4 2 Whitelist IPs Rotating Pro 1MLow Speed (1X) 20 Threads Unmetered Traffic 8152 Premium IPs HTTP(s) & Socks5/4 1 Whitelist IP We accept paypal, credit card, bitcoin, webmoney, and many other payment methods. All plans include a 15-day money-back guarantee. FAQsFrequently asked questions about our rotating proxy What is the speed of each package? Here is the speed of each package. 1M package – 1Mbps = 128 KB/s2M package – 2Mbps = 256 KB/s5M package – 5Mbps = 640 KB/sWhat is 1Mbps? It is the traffic speed, 1 million bits per second. What is unmetered traffic? We don’t meter the traffic you used. What are threads? 100 threads = 100 concurrent connectionsIn the fast rotating mode, you can send 100 requests to the gateway proxy in one second to use 100 IP the slow rotating mode, you can use 100 gateway proxies you bought the 100 threads plan and sent 200 requests in one second, the last 100 requests would fail. In this case, you can buy two 5M licenses. What are the proxies behind the rotating proxy? We own and control all the 8152 proxies in 52 countries. Those proxies are stable and always working. Their success rate is 99%. What is HTTP(s)/Socks? There are three types of proxy is for HTTP websites, such as proxy is for both HTTP and HTTPS websites. It supports while HTTP proxy does cks5/4 proxy is a versatile proxy for all your Internet usage, such as FTP, SMTP, IRC, HTTP, HTTPS is a part of the HTTP protocol, sometimes we call HTTPS proxy as HTTP proxy too. What is whitelist IP? Our rotating proxy service supports two authentication ername/Password: You can use this method if your IP changes from time to time. Whitelist IP: You can use this method if your program doesn’t support the user/pass the fast rotating (one proxy) mode and slow rotating (proxy list) mode use the same authentication methods. How to use it? 1. Whitelist your IP for “IP Authentication” in the client area. Otherwise, the proxy will deny your requests. 2. Input that proxy to the proxy option of your IP: (get from the client area)Proxy Port: 2000 (HTTP/s) or 3000 (Socks5/4)3. How to check the real proxy IP behind that proxy? Use that proxy to surf this show-my-IP page: the proxy rotates IP every second, you will see a new IP every time. Here are more detailed tutorials for you. Can I rotate IP every 3 minutes? We provide 500 slow-rotating ports (20001~20500 or 30001~30500) that rotate IPs every 30 minutes. You can use one of them for 3 minutes and then change to the you want to rotate IP every second, please use the fast-rotating port 2000 or 3000. Do your proxies support mailing? No. We don’t have mailing proxies. You can buy them from this vendor. Find the Mail Special package in the Popular rates section. Are your proxies residential? No. Our proxies are from datacenters. You can buy rotating residential proxies from this vendor. Are the proxies exclusive to me? No, they are shared, not exclusive. What websites do you support? You can buy a 3-day refundable trial to check whether it works for your target provide a 15-day money-back guarantee. If not satisfied, you can request a full refund. Can I buy proxies in the US, UK, or Europe only? The backend IPs are in 50+ countries. You can filter the proxy country roughly. We support these CountriesUnited StatesUnited KingdomEuropeUSA & EuropeOthersIf you want to choose IPs for a specific country, please follow this instruction. Can I get completely different proxies every day? No. Our IP pool only has 8152 proxies. They won’t change daily. Can I get more proxies if I buy two licenses? No. Our proxy pool (8152 IPs) is for all the users. You won’t get 2×8152 IPs with two ever, you can get more threads and bandwidth with two licenses. What is a subnet? The IPs in A. B. C. 0 ~ A. 255 (ex. 11. 22. 0 ~ 11. 255) are in the same ‘s easy for websites to trace or block IPs from the same vendors usually sell 10K proxies in 50 subnets. Our subnets are much more. Is it expensive? Our service is worth the price. Each private proxy usually charges more than $1/month. You can view their pricing provide 8000+ proxies at $29. 97/month. Each proxy charges less than $0. 004. Other vendors usually sell 10K proxies in 50 subnets. We sell 8000+ proxies in 700+ Click on the heading text to expand or collapse atisticsWe have 8152 premium proxies in 52 countriesTotal 8152 IPs in 743 Subnets in 52 CountriesTotal8152Subnet 743Google1085Asia138S. A. 14Europe4477 US3492 NL1910 RU578 EE555 GB340 FI218 PL176 DE160 CA149 FR56 UA51 AU32 CH23 NO21 BY21 SG21 JP19 SE19 DK19 HK19 BE18 ES16 RO16 TW14 MY13 MX13 IN12 NZ12 AT11 BR11 IT11 ID11 IE10 IS10 BG10Others85Start your 15-day risk-free trial now! Try Rotating Proxy Now
SSL Proxies
Daily Free SSL Proxies
Pages
Home
Contact Us
Privacy Policy
Best Proxy Sites
Strong VPN
Express VPN
Brave Browser
Friday, May 29, 2020
28-05-20 | Free SSL Proxies (1480)
1480 Free SSL Proxies (Secure Socket Layer Proxies)
Read more »
Posted by
Techxat
at
11:29 AM
No comments:
Labels:
Proxy SSL,
SSL Proxy
28-05-20 | IRC Proxy Servers (630)
630 fresh checked IRC (Internet Relay Chat) Proxy Servers
11:05 AM
IRC Proxies,
IRC Proxy
26-05-20 | Free SSL Proxies (1110)
1110 Free SSL Proxies (Secure Socket Layer Proxies)
1:25 AM
Older Posts
Subscribe to:
Posts (Atom)
sonertari/SSLproxy: Transparent SSL/TLS proxy for … – GitHub
Copyright (C) 2017-2021, Soner Tari.
Copyright (C) 2009-2019, Daniel Roethlisberger.
Overview
SSLproxy is a proxy for SSL/TLS encrypted network connections. It is intended
to be used for decrypting and diverting network traffic to other programs, such
as UTM services, for deep SSL inspection.
The UTMFW project uses SSLproxy to
decyrpt and feed network traffic into its UTM services: Web Filter, POP3
Proxy, SMTP Proxy, and Inline IPS; and also indirectly into Virus Scanner and
Spam Filter through those UTM software. Given that most of the Internet
traffic is encrypted now, it wouldn’t be possible without SSLproxy to deeply
inspect most of the network traffic passing through UTMFW.
See this presentation
for a summary of SSL interception and potential issues with middleboxes that
support it.
Mode of operation
SSLproxy is designed to transparently terminate connections that are redirected
to it using a network address translation engine. SSLproxy then terminates
SSL/TLS and initiates a new SSL/TLS connection to the original destination
address. Packets received on the client side are decrypted and sent to the
program listening on a port given in the proxy specification. SSLproxy inserts
in the first packet the address and port it is expecting to receive the packets
back from the program. Upon receiving the packets back, SSLproxy re-encrypts
and sends them to their original destination. The return traffic follows the
same path back to the client in reverse order.
This is similar in principle to divert
sockets, where the packet filter diverts the
packets to a program listening on a divert socket, and after processing the
packets the program reinjects them into the kernel. If there is no program
listening on that divert socket or the program does not reinject the packets
into the kernel, the connection is effectively blocked. In the case of
SSLproxy, SSLproxy acts as both the packet filter and the kernel, and the
communication occurs over networking sockets.
SSLproxy supports split mode of operation similar to SSLsplit as well. In
split mode, packets are not diverted to listening programs, effectively making
SSLproxy behave similar to SSLsplit, but not exactly like it, because SSLproxy
has certain features non-existent in SSLsplit, such as user authentication and
protocol validation. Also, note that the implementation of proxy core in
SSLproxy is different from the one in SSLsplit, for example the proxy core in
SSLproxy runs lockless, whereas SSLsplit implementation uses thread manager
level locks (which does not necessarily make sslproxy run faster than
sslsplit). In SSLproxy, split mode can be defined globally or per-proxyspec.
SSLproxy does not automagically redirect any network traffic. To actually
implement a proxy, you also need to redirect the traffic to the system running
sslproxy. Your options include running sslproxy on a legitimate router, ARP
spoofing, ND spoofing, DNS poisoning, deploying a rogue access point (e. g.
using hostap mode), physical recabling, malicious VLAN reconfiguration or
route injection, /etc/hosts modification and so on.
Proxy specification
For example, given the following proxy specification:
127. 0. 1 8443 up:8080
SSLproxy listens for HTTPS connections on 127. 1:8443.
Upon receiving a connection from the Client, it decrypts and diverts the
packets to a Program listening on 127. 1:8080. The default divert address
is 127. 1, which can be configured by the ua option.
After processing the packets, the Program gives them back to SSLproxy
listening on a dynamically assigned address, which the Program obtains from
the SSLproxy line in the first packet in the connection.
Then SSLproxy re-encrypts and sends the packets to the Server.
The response from the Server follows the same path back to the Client in
reverse order.
Along with one line proxyspecs above, SSLproxy supports structured proxyspecs
to configure further options per proxyspec. It also supports split style
proxyspecs for split mode of operation similar to SSLsplit. See
(5) for structured proxyspecs, and the SSLsplit documentation for
split style proxyspecs.
SSLproxy line
A sample line SSLproxy inserts into the first packet in the connection is the
following:
SSLproxy: [127. 1]:34649, [192. 168. 3. 24]:47286, [192. 111. 130]:443, s
The first IP:port pair is a dynamically assigned address that SSLproxy
expects the program send the packets back to it.
The second and third IP:port pairs are the actual source and destination
addresses of the connection respectively. Since the program receives the
packets from SSLproxy, it cannot determine the source and destination
addresses of the packets by itself, e. g by asking the NAT engine, hence must
rely on the information in the SSLproxy line.
The last letter is either s or p, for SSL/TLS encrypted or plain traffic
respectively. This information is also important for the program, because it
cannot reliably determine if the actual network traffic it is processing was
encrypted or not before being diverted to it.
Listening program
The program that packets are diverted to should support this mode of operation.
Specifically, it should be able to recognize the SSLproxy address in the first
packet, and give the first and subsequent packets back to SSLproxy listening
on that address, instead of sending them to the original destination as it
normally would.
You can use any software as a listening program as long as it supports this
mode of operation. So existing or new software developed in any programming
language can be modified to be used with SSLproxy to inspect and/or modify any
or all parts of the packets diverted to it.
You can offload the system SSLproxy is running on by diverting packets to
remote listening programs too. For example, given the following proxy
specification:
127. 1 8443 up:8080 ua:192. 1 ra:192. 1. 1
The ua option instructs SSLproxy to divert packets to 192. 1:8080,
instead of 127. 1:8080 as in the previous proxyspec example.
The ra option instructs SSLproxy to listen for returned packets from the
program on 192. 1, instead of 127. 1 as in the previous SSLproxy line.
Accordingly, the SSLproxy line now becomes:
SSLproxy: [192. 130]:443, s
So, the listening program can be running on a machine anywhere in the world.
Since the packets between SSLproxy and the listening program are always
unencrypted, you should be careful while using such a setup.
Protocols
Supported protocols
SSLproxy supports plain TCP, plain SSL, HTTP, HTTPS, POP3, POP3S, SMTP, and
SMTPS connections over both IPv4 and IPv6. It also has the ability to
dynamically upgrade plain TCP to SSL in order to generically support SMTP
STARTTLS and similar upgrade mechanisms. Depending on the version of OpenSSL,
SSLproxy supports SSL 3. 0, TLS 1. 1, TLS 1. 2, and TLS 1. 3, and
optionally SSL 2. 0 as well. SSLproxy supports Server Name Indication (SNI),
but not Encrypted SNI in TLS 1. It is able to work with RSA, DSA and ECDSA
keys and DHE and ECDHE cipher suites.
The following features of SSLproxy are IPv4 only:
Divert addresses for listening programs in proxyspecs
SSLproxy return addresses dynamically assigned to connections
IP addresses in the ua and ra options
IP and ethernet addresses of clients in user authentication
Target IP and ethernet addresses in mirror logging
OCSP, HPKP, HSTS, Upgrade et al.
SSLproxy implements a number of defences against mechanisms which would
normally prevent MitM attacks or make them more difficult. SSLproxy can deny
OCSP requests in a generic way. For HTTP and HTTPS connections, SSLproxy
mangles headers to prevent server-instructed public key pinning (HPKP), avoid
strict transport security restrictions (HSTS), avoid Certificate Transparency
enforcement (Expect-CT) and prevent switching to QUIC/SPDY, HTTP/2 or
WebSockets (Upgrade, Alternate Protocols). HTTP compression, encodings and
keep-alive are disabled to make the logs more readable.
Another reason to disable persistent connections is to reduce file descriptor
usage. Accordingly, connections are closed if they remain idle for a certain
period of time. The default timeout is 120 seconds, which can be configured by
the ConnIdleTimeout option.
Protocol validation
Protocol validation makes sure the traffic handled by a proxyspec is using the
protocol specified in that proxyspec. The ValidateProto option can be used to
enable global and/or per-proxyspec protocol validation. This feature currently
supports HTTP, POP3, and SMTP protocols. If a connection cannot pass protocol
validation, then it is terminated.
SSLproxy uses only client requests for protocol validation. However, it also
validates SMTP responses until it starts processing the packets from the
client. If there is no excessive fragmentation, the first couple of packets in
the connection should be enough for validating protocols.
Certificates
Certificate forging
For SSL and HTTPS connections, SSLproxy generates and signs forged X509v3
certificates on-the-fly, mimicking the original server certificate’s subject
DN, subjectAltName extension and other characteristics. SSLproxy has the
ability to use existing certificates of which the private key is available,
instead of generating forged ones. SSLproxy supports NULL-prefix CN
certificates but otherwise does not implement exploits against specific
certificate verification vulnerabilities in SSL/TLS stacks.
Certificate verification
SSLproxy verifies upstream certificates by default. If the verification fails,
the connection is terminated immediately. This is in contrast to SSLsplit,
because in order to maximize the chances that a connection can be successfully
split, SSLsplit accepts all certificates by default, including self-signed
ones. See The Risks of SSL Inspection
for the reasons of this difference. You can disable this feature by the
VerifyPeer option.
Client certificates
SSLproxy uses the certificate and key from the pemfiles configured by the
ClientCert and ClientKey options when the destination requests client
certificates. These options can be defined globally and/or per-proxyspec.
Alternatively, you can use Pass filtering rules to pass through certain
destinations requesting client certificates.
User authentication
If the UserAuth option is enabled, SSLproxy requires network users to log in
to the system to establish connections to the external network.
SSLproxy determines the user owner of a connection using a users table in an
SQLite3 database configured by the UserDBPath option. The users table should
be created using the following SQL statement:
CREATE TABLE USERS(
IP CHAR(45) PRIMARY KEY NOT NULL,
USER CHAR(31) NOT NULL,
ETHER CHAR(17) NOT NULL,
ATIME INT NOT NULL,
DESC CHAR(50));
SSLproxy does not create this users table or the database file by itself, nor
does it log users in or out. So the database file and the users table should
already exist at the location pointed to by the UserDBPath option. An external
program should log users in and out on the users table. The external program
should fill out all the fields in user records, except perhaps for the DESC
field, which can be left blank.
When SSLproxy accepts a connection,
It searches the client IP address of the connection in the users table. If
the client IP address is not in the users table, the connection is redirected
to a login page configured by the UserAuthURL option.
If SSLproxy finds a user record for the client IP address in the users
table, it obtains the ethernet address of the client IP address from the arp
cache of the system, and compares it with the value in the user record for
that IP address. If the ethernet addresses do not match, the connection is
redirected to the login page.
If the ethernet addresses match, SSLproxy compares the atime value in the
user record with the current system time. If the difference is greater than
the value configured by the UserTimeout option, the connection is redirected
to the login page.
If the connection passes all these checks, SSLproxy proceeds with establishing
the connection.
The atime of the IP address in the users table is updated with the system time
while the connection is being terminated. Since this atime update is executed
using a privsep command, it is expensive. So, to reduce the frequency of such
updates, it is deferred until after the user idle time is more than half of
the timeout period.
If a description text is provided in the DESC field, it can be used with
filtering rules to treat the user logged in from different locations, i. e.
from different client IP addresses, separately.
If the UserAuth option is enabled, the user owner of the connection is
appended at the end of the SSLproxy line, so that the listening program can
parse and use this information in its logic and/or logging:
SSLproxy: [127. 130]:443, s, soner
The user authentication feature is currently available on OpenBSD and Linux
only.
Filtering rules
SSLproxy can divert, split, pass, block, or match connections based on
filtering rules. Filtering rules can be defined globally or per-proxyspec.
Divert action diverts packets to listening program, allowing SSL inspection
by listening program and content logging of packets
Split action splits the connection but does not divert packets to listening
program, effectively disabling SSL inspection by listening program, but
allowing content logging of packets
Pass action passes the connection through by engaging passthrough mode,
effectively disabling SSL inspection and content logging of packets
Block action terminates the connection
Match action specifies log actions for the connection without changing its
filter action
The syntax of filtering rules is as follows:
(Divert|Split|Pass|Block|Match)
([from (
user (username[*]|$macro|*) [desc (desc[*]|$macro|*)]|
desc (desc[*]|$macro|*)|
ip (clientip[*]|$macro|*)|
*)]
[to (
(sni (servername[*]|$macro|*)|
cn (commonname[*]|$macro|*)|
host (host[*]|$macro|*)|
uri (uri[*]|$macro|*)|
ip (serverip[*]|$macro|*)) [port (serverport[*]|$macro|*)]|
port (serverport[*]|$macro|*)|
[log ([[! ]connect] [[! ]master] [[! ]cert]
[[! ]content] [[! ]pcap] [[! ]mirror] [$macro]|[! ]*)]
|*) [# comment]
The definition of which connections the rule action will be applied to is
achieved by the from and to parts of a filtering rule and by the proxyspec
that the rule is defined for.
The from part of a rule defines source filter based on client IP address,
user and/or description, or * for all.
The to part defines destination filter based on server IP and/or port, SNI
or Common Names of SSL connections, Host or URI fields in HTTP Request
headers, or * for all.
Dst Host type of rules use the ip site field
SSL type of rules use the sni or cn site field
HTTP type of rules use the host or uri site field
All rule types can use the port field
The proxyspec handling the connection defines the protocol filter for the
connection.
If and how a connection should be logged is specified using the log part of
filtering rules:
connect enables logging connection information to connect log file
master enables logging of master keys
cert enables logging of generated certificates
content enables logging packet contents to content log file
pcap enables writing packets to pcap files
mirror enables mirroring packets to mirror interfaces or targets
You can add a negation prefix! to a log action to disable that logging.
For example, if the following rules are defined in a structured HTTPS proxyspec,
Split from user soner desc notebook to sni log content
Pass from user soner desc android to cn *
The first filtering rule above splits but does not divert HTTPS connections
from the user soner who has logged in with the description notebook to SSL
sites with the SNI of Also, the rule specifies that the packet
contents of the matching connection be written to content log file configured
globally.
The second rule passes through HTTPS connections from the user soner who has
logged in with the description android to SSL sites with the Common Names
containing the substring anywhere in it (notice the asterisk at the
end). Since connection contents cannot be written to log files in passthrough
mode, the rule does not specify any content log action.
The default filter action is Divert. So, if those are the only filtering rules
in that proxyspec, the other connections are diverted to the listening program
specified in that proxyspec, without writing any logs.
If you want to enable, say, connect logging for the other connections handled
by that proxyspec, without changing their default Divert filter action, you
can add a third filtering rule to that proxyspec:
Note that the second example above is a filtering rule you can use to resolve
one of the certificate issues preventing the Facebook application on Android
smartphones to connect to the Internet behind sslproxy.
Filtering rules are applied based on certain precedence orders:
More specific rules have higher precedence. Log actions increase rule
precedence too, but this effects log actions only, not the precedence of
filter actions.
The precedence of filter types is as HTTP > SSL > Dst Host. Because, the
application order of filter types is as Dst Host > SSL > HTTP, and a filter
type can override the actions of a preceding filter type.
The precedence of filter actions is as Divert > Split > Pass > Block. This is
only for the same type of filtering rules.
The precedence of site fields is as sni > cn for SSL filter and host > uri
for HTTP filter.
For example, the pass action of a Dst Host filter rule is taken before the
split action of an SSL filter rule with the same from definition, due to the
precedence order of filter types. Or, the pass action of a rule with sni site
field is taken before the split action of the same rule with cn site field, due
to the precedence order of site fields.
In terms of possible filter actions,
Dst Host filtering rules can take all of the filter and log actions.
SSL filtering rules can take all of the filter and log actions.
HTTP filtering rules can take match and block filter actions, can keep
enabled divert and split modes, but cannot take pass action. Also, HTTP
filtering rules can only disable logging.
Log actions do not configure any loggers. Global loggers for respective log
actions should have been configured for those log actions to have any effect.
If no filtering rules are defined for a proxyspec, all log actions for that
proxyspec are enabled. Otherwise, all log actions are disabled, and filtering
rules should enable them specifically.
Macro expansion is supported. The Define option can be used for defining
macros to be used in filtering rules. Macro names must start with a $ char.
The macro name must be followed by words separated with spaces.
You can append an asterisk * to the fields in filtering rules for substring
matching. Otherwise, the filter searches for an exact match with the field in
the rule. The filter uses B-trees for exact string matching and Aho-Corasick
machines for substring matching.
The ordering of filtering rules is important. The ordering of from, to, and
log parts is not important. The ordering of log actions is not important.
If the UserAuth option is disabled, only client IP addresses can be used in
the from part of filtering rules.
Excluding sites from SSL inspection
PassSite option is a special form of Pass filtering rule. PassSite rules can
be written as Pass filtering rules. The PassSite option will be deprecated in
favor of filtering rules in the future.
PassSite option allows certain SSL sites to be excluded from SSL inspection.
If a PassSite matches the SNI or common names in the SSL certificate of a
connection, that connection is passed through the proxy without being diverted
to the listening program. SSLproxy engages the Passthrough mode for that
purpose. For example, sites requiring client authentication can be added as
PassSite.
Per-site filters can be defined using client IP addresses, users, and
description. If the UserAuth option is disabled, only client IP addresses can
be used in PassSite filters. Multiple sites can be defined, one on each line.
PassSite rules can search for exact or substring matches. PassSite rules do
not support macro expansion.
User control lists
User control lists can be implemented using filtering rules. The DivertUsers
and PassUsers options will be deprecated in favor of filtering rules in the
future.
DivertUsers and PassUsers options can be used to divert, pass through, or
block users.
If neither DivertUsers nor PassUsers is defined, all users are diverted to
listening programs.
Connections from users in DivertUsers, if defined, are diverted to listening
programs.
Connections from users in PassUsers, if defined, are simply passed through
to their original destinations. SSLproxy engages the Passthrough mode for that
purpose.
If both DivertUsers and PassUsers are defined, users not listed in either of
the lists are blocked. SSLproxy simply terminates their connections.
If no DivertUsers list is defined, only users not listed in PassUsers
are diverted to listening programs.
These user control lists can be defined globally or per-proxyspec. User
control lists do not support macro expansion.
Logging
Logging options include traditional SSLproxy connect and content log files as
well as PCAP files and mirroring decrypted traffic to a network interface.
Additionally, certificates, master secrets and local process information can be
logged. Filtering rules can selectively modify connection logging.
See the manual pages sslproxy(1) and (5) for details on using
SSLproxy, setting up the various NAT engines, and for examples.
Requirements
SSLproxy depends on the OpenSSL, libevent 2. x, libpcap, libnet 1. x, and
sqlite3 libraries by default. Libpcap and libnet are not needed if the
mirroring feature is omitted. Sqlite3 is not needed if the user authentication
feature is omitted. The build depends on GNU make and a POSIX. 2 environment
in PATH. If available, pkg-config is used to locate and configure the
dependencies. The optional unit tests depend on the check library. The
optional end-to-end tests depend on the TestProxy
tool, and are supported only on Linux.
SSLproxy currently supports the following operating systems and NAT mechanisms:
FreeBSD: pf rdr and divert-to, ipfw fwd, ipfilter rdr
OpenBSD: pf rdr-to and divert-to
Linux: netfilter REDIRECT and TPROXY
Mac OS X: pf rdr and ipfw fwd
Support for local process information (-i) is currently available on Mac OS X
and FreeBSD.
SSL/TLS features and compatibility greatly depend on the version of OpenSSL
linked against. For optimal results, use a recent release of OpenSSL or
LibreSSL.
Installation
With the requirements above available, run:
make
make test # optional unit and e2e tests
make sudotest # optional unit tests requiring privileges
make install # optional install
Dependencies are autoconfigured using pkg-config. If dependencies are not
picked up and fixing PKG_CONFIG_PATH does not help, you can specify their
respective locations manually by setting OPENSSL_BASE, LIBEVENT_BASE,
LIBPCAP_BASE, LIBNET_BASE, SQLITE_BASE and/or CHECK_BASE to the
respective prefixes.
You can override the default install prefix (/usr/local) by setting PREFIX.
For more build options and build-time defaults see GNUmakefile
and defaults. h.
Documentation
See the manual pages sslproxy(1) and (5) for user
documentation. See for release notes listing significant
changes between releases and for information on
security vulnerability disclosure.
License
SSLproxy is provided under a 2-clause BSD license.
SSLproxy contains components licensed under the MIT and APSL licenses.
See LICENSE, ntrib and
as well as the respective source file headers
for details.
Credits
See for the list of contributors.
SSLproxy was inspired by and has been developed based on SSLsplit
by Daniel Roethlisberger.