SSLBUMP without MITM



  • what about peek & splice? no cert on client:

    Always enable manual proxy

    http_port 3128

    Enable transparent proxy

    http_port 3129 transparent

    Enable SSL transparent proxy

    https_port 3130 intercept ssl-bump generate-host-certificates=off cert=/etc/pki/tls/certs/squid.crt key=/etc/pki/tls/private/squid.key sslflags=NO_DEFAULT_CA options=NO_SSLv2,NO_SSLv3,No_Compression dynamic_cert_mem_cache_size=128KB
    acl https_proto proto https
    always_direct allow https_proto
    ssl_bump none localhost
    sslproxy_options NO_SSLv2,NO_SSLv3,No_Compression
    sslproxy_cipher ALL:!SSLv2:!ADH:!DSS:!MD5:!EXP:!DES:!PSK:!SRP:!RC4:!IDEA:!SEED:!aNULL:!eNULL

    TLS/SSL bumping definitions

    acl tls_s1_connect at_step SslBump1
    acl tls_s2_client_hello at_step SslBump2
    acl tls_s3_server_hello at_step SslBump3

    TLS/SSL bumping steps

    ssl_bump peek tls_s1_connect all
    ssl_bump splice all

    peek at TLS/SSL connect data

    splice: no active bumping

    Enable squidGuard

    url_rewrite_program /usr/sbin/squidguard -l /var/squid/logs
    url_rewrite_children 20 startup=5 idle=5 concurrency=0
    url_rewrite_extras "%>a/%>A %un %>rm bump_mode=%ssl::bump_mode sni="%ssl::>sni" referer="%{Referer}>h""



  • I'm confused  :-[

    1 - Is there any question?
    2 - I even don't understand title. To me SSLBump and Man In The Middle are synonyms here


  • Banned

    Ditto. So why are you setting up transparent proxy in the first place if that's not what you want?



  • @chris4916:

    I'm confused  :-[

    1 - Is there any question?
    2 - I even don't understand title. To me SSLBump and Man In The Middle are synonyms here
    [/quote]

    ok i'm not an english spokesman so sorry for my poor language, with the configuration abobe it is possible to "Transparent" Squid with filtering of HTTPS of resources without substitution of certificates. how to accomplishe this with pfsense?

    best regards.



  • @bbassotti:

    @chris4916:

    I'm confused  :-[

    1 - Is there any question?
    2 - I even don't understand title. To me SSLBump and Man In The Middle are synonyms here
    [/quote]

    ok i'm not an english spokesman so sorry for my poor language, with the configuration abobe it is possible to "Transparent" Squid with filtering of HTTPS of resources without substitution of certificates. how to accomplishe this with pfsense?

    best regards.

    with the above config i'm able to transparently check the ssl without explict proxy config on the client.

    best regards.


  • Banned

    Yes, that's the whole point of transparent proxy. And you cannot do any SSL bump without faking the certs when transparent. Now that you have effectively made the SSL proxy no-op with splicing all, you could as well turn it off, no?

    Splice: Become a TCP tunnel without decoding the connection. The client and the server exchange data as if there is no proxy in between.



  • @doktornotor:

    Yes, that's the whole point of transparent proxy. And you cannot do any SSL bump without faking the certs when transparent. Now that you have effectively made the SSL proxy no-op with splicing all, you could as well turn it off, no?

    Splice: Become a TCP tunnel without decoding the connection. The client and the server exchange data as if there is no proxy in between.

    yes and no, with the above config, as i've previously explained, i can check the NAME of the ssl connection then with squidguard i can block/pass whitout install ANY certificate on the client so i can block the connection from any device (android/ios etc).

    Best regards.


  • Banned

    Well no - not in Squid alone at least, since you've spliced the whole thing, so you cannot block anything there. What you'e produced is just useful possibly for logging/monitoring.

    (No idea about SquidGuard, since that thing is goddamn broken, unreadable, unmaintained mess. Just won't touch it.)



  • @doktornotor:

    Well no - not in Squid alone at least, since you've spliced the whole thing, so you cannot block anything there. What you'e produced is just useful possibly for logging/monitoring.

    (No idea about SquidGuard, since that thing is goddamn broken, unreadable, unmaintained mess. Just won't touch it.)

    :o I'm using it on nethserver :) so Yes it is possible with squid 3.5.20.

    best regards.


  • Banned

    Yeah, wonderful. This is pfSense forum. So, the point of this thread is exactly what? You've made a TCP tunnel out of any SSL connection in Squid. Great. Proxy invisible, traffic through. So, now what? (Again, I'm not talking about Squidguard, and I'm definitely NOT talking about nethserver or what's that.)



  • @doktornotor:

    Yeah, wonderful. This is pfSense forum. So, the point of this thread is exactly what? You've made a TCP tunnel out of any SSL connection in Squid. Great. Proxy invisible, traffic through. So, now what? (Again, I'm not talking about Squidguard, and I'm definitely NOT talking about nethserver or what's that.)

    yes i know  :) I'm asking IF it possible to obtain the same with pfsense and NOT to compare this with what, or IF in future release and I'm not ask for the moon!

    best regards.


  • Banned

    If you want SSL bump to have any chance of working, you need this patch on top of latest Squid package on pfSense. Now, with that patch, whatever is whitelisted should get through (spliced), the rest will get bumped (and dealth with by stuff like Squidguard or whatever else, again, not tested, will not touch). Since, that's the approach that was there from the very beginning and that made sense for users. Making a transparent TCP tunnel is not exactly the goal people are trying to produce.



  • hi bbassotti

    The following topic maybe helps you

    https://forum.pfsense.org/index.php?topic=123874.0



  • This peek and slice permits Squidguard and Squid to block https://pages according the rules set in SquidGuardian/Squid, without decoding the rest of the pages.

    Usually it's just what everybody needs!

    I've learned this in pratice and tried it with OpnSense (a fork of pfSense) and I've been hugely surprised how effective it is!

    So I copied and pasted from their squid.conf the excerpt below in the Service/Squid Proxy Server/General/Show Advanced Options/Custom ACLS (Before Auth):

    setup ssl bump acl's

    acl bump_step1 at_step SslBump1
    acl bump_step2 at_step SslBump2
    acl bump_step3 at_step SslBump3
    acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl"

    configure bump

    ssl_bump peek bump_step1 all
    ssl_bump splice all
    ssl_bump peek bump_step2 all
    ssl_bump splice bump_step3 all

    ssl_bump bump

    sslproxy_cert_error deny all



  • This procedure (after activating SSL Filtering in the SSL Man in the Middle Filtering) does this job wonderfully, and WITHOUT the need of Man In the Middle Filtering, without any need of certs added to the clients.

    Only the URL is decoded and blocked (or permitted) as configured in Squidguard/Squid.

    I use pfBlockerNG too for the others critical blockings that need to be done on the battlefield that the Internet has become today!



  • Sorry, I forgot to say that I'm using this without Transparent Proxy.

    I'm using proxy.pac (and symlinks to it: wpad.dat and wpad.da) in the following way:

    1. Installed Shellcmd, Cron, Squidguard and Squid packages.

    2. in Services/Shellcmd, click Add
          Add Command:
              /usr/local/etc/rc.d/nginx onestart
          Shellcmd Type:
              shellcmd
          Description:
              2nd. instance nginx for wpad
          and click Save.

    3. In Services/Cron, click Add
          Fill Minute with */3, User root and Command
              [ -f /var/run/nginx.pid ] && true || /usr/local/etc/rc.d/nginx onestart

    4. My pfSense firewall has LAN IP 192.168.192.1, so you change the IP to YOUR pfSense IP in the proxy.pac I pasted right after this post and use Diagnostics/Edit File to copy, paste and save in /usr/local/www/nginx/proxy.pac

    5. Create symlinks wpad.dat and wpad.da of proxy.pac in the same directory.

    6. Create rules to force proxy use. The clients that use Detect Automatically in the browser usually gets thru the proxy, but follow the instructions that you'll find in this forum about wpad.dat configuration in Squid.

    7. Client browsers may be configured to use proxy by manual configuration of course.



  • The proxy.pac I use follows:

    function FindProxyForURL(url, host) {

    var wpad = "DIRECT";
      // Return wpad;  // by-pass when you wish to put Squid Proxy offline without removing proxy.pac

    host = host.toLowerCase();

    var hostIP;
      var isIpV4Addr = /^(\d+.){3}\d+$/;

    if (isIpV4Addr.test(host))
        hostIP=host;
      else
        hostIP=dnsResolve(host);
      if (hostIP != 0) {
        if (isPlainHostName(host) ||
            shExpMatch(host, ".local") ||
            shExpMatch(host, ".localdomain.local") ||
            shExpMatch(hostIP, "10.") ||
            shExpMatch(hostIP, "192.168.
    ") ||
            shExpMatch(hostIP, "127.") ||
            isInNet(hostIP, "172.16.0.0", "255.240.0.0") ||
            shExpMatch(host, "fe80::
    "))
          return wpad;
    // Main LAN
        var myIP = myIpAddress();
        if (shExpMatch(myIP, "169.254.*") ||
            isInNet(myIP, "192.168.192.0", "255.255.252.0"))
          wpad = "PROXY 192.168.192.1:3128; DIRECT";
    // For additional LAN subnets (example)
        else if (isInNet(myIP, "192.168.198.0", "255.255.252.0"))
          wpad = "PROXY 192.168.198.1:3128; DIRECT";
      }
      return wpad;
    }



  • @tadaog:

    This peek and slice permits Squidguard and Squid to block https://pages according the rules set in SquidGuardian/Squid, without decoding the rest of the pages.

    Usually it's just what everybody needs!

    I've learned this in pratice and tried it with OpnSense (a fork of pfSense) and I've been hugely surprised how effective it is!

    So I copied and pasted from their squid.conf the excerpt below in the Service/Squid Proxy Server/General/Show Advanced Options/Custom ACLS (Before Auth):

    setup ssl bump acl's

    acl bump_step1 at_step SslBump1
    acl bump_step2 at_step SslBump2
    acl bump_step3 at_step SslBump3
    acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl"

    configure bump

    ssl_bump peek bump_step1 all
    ssl_bump splice all
    ssl_bump peek bump_step2 all
    ssl_bump splice bump_step3 all

    ssl_bump bump

    sslproxy_cert_error deny all

    Thank you ! This work also with transparent proxy  :)



  • i am the person who did this change to opnsense, if you want and the maintaner of package accepts, i could do a pull request with this change.
    note: it works only with domain and not with complete urls, because dont do the intercept


  • Banned

    @fabiomello:

    i am the person who did this change to opnsense, if you want and the maintaner of package accepts, i could do a pull request with this change.

    So, this could be pretty much rewritten to:

    setup ssl bump acl's

    acl bump_step1 at_step SslBump1
    acl bump_step2 at_step SslBump2
    acl bump_step3 at_step SslBump3
    acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl"

    configure bump

    ssl_bump peek bump_step1 all
    ssl_bump splice all
    ssl_bump peek bump_step2 all
    ssl_bump splice bump_step3 all
    ssl_bump bump

    sslproxy_cert_error deny all

    @fabiomello:

    note: it works only with domain and not with complete urls, because dont do the intercept

    Yes, that is the problem. It does not intercept. Most of the code does nothing, as indicated above. It splices everything, you are finished with the stuff after the red line marked above [1].

    What the code in pfSense Squid attempts to do is: do NOT intercept 'Whitelist' ACL (that's what your no-op bump_nobumpsites ACL attempts to do but the code is just not used anywhere) and intercept the rest [2]

    [1] https://github.com/pfsense/FreeBSD-ports/blob/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1539
    [2]
    https://github.com/pfsense/FreeBSD-ports/blob/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1826
    https://github.com/pfsense/FreeBSD-ports/blob/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1887

    I must be missing something here.



  • doktornotor:

    You patch does getting the full https URL only and wonderfully, it we put ".*" at the whitelist, so that squidguard can do its job of denying or allowing it according its rules, exactly as it does with http.

    So, to summarize, putting in the whitelist field:

    .*

    and squidGuard does its jobs with http and https URLs!!!


  • Banned

    OK, so I guess there are no changes really required for the SquidGuard + SSL usecase. Thanks for feedback.


  • Rebel Alliance Developer Netgate

    To summarize, this does work with transparent interception without installing a CA on clients, but I can only get it to see the domain name, not the full URL as some in the thread have stated.

    • Squid General tab, Show Advanced Options, Custom ACLs (before auth)
    acl bump_step1 at_step SslBump1
    ssl_bump peek bump_step1 all
    ssl_bump splice all
    sslproxy_cert_error deny all
    
    • ACLs tab, whitelist:```
      .*
    
    When squidGuard blocks it kills the connection, it doesn't redirect or do anything nice.
    
    And naturally this doesn't let you see the body so no chance for AV or similar to check the contents.

  • Banned

    @jimp: As I understand the previous post, there's really no need to put anything into Custom ACLs; the code is equivalent to what we have in the package already when you whitelist everything (.*) - there's

    ssl_bump splice whitelist
    ssl_bump bump all

    (and the second line won't have anything to match left when you've whitelisted everything)


  • Rebel Alliance Developer Netgate

    Ah, so all you need is the whitelist ".*" and the rest happens automatically? Cool. That does seem to work.


  • Banned

    Yeah, it's basically "supertransparent", as in - no certificates forged/no need to install certs on clients. (And yeah, obviously it's limited in sense that you just get enough info about the connection for SquidGuard to do its job, but nothing else, i.e., no content filtering/AV/etc.)

    Perhaps could use some hints in the GUI…


  • Rebel Alliance Developer Netgate

    Would be nice to kick that in somehow when CA = "None" when using SSL Interception, or at least allow CA = None to be set in that case. It doesn't seem like that should be necessary since it isn't going to be using the CA when acting in that role. I haven't tried it though, maybe squid is dumb and still needs it set.


  • Banned

    Yeah, afraid that's a no go, the certs are really required - plus, the ACL (whitelist) can be anything there and be changed at any time,  or have lines prepended/appended, really no way for Squid to figure out it's not going to need to fake any certs.

    (But you could generate a temporary one for the CA in the background on each config resync; would need additional logic/code though in squid.inc. If you want something like this, I'd prefer having a separate checkbox for this, with some JS logic that'd gray out/disable unneeded MITM stuff in the GUI, and use a different ACL than the current whitelist for that, basically just use the built-in "all" one - like ssl_bump splice all)



  • I'm running a variation of this config in transparent mode with squidguard and shallalist quite successfully.

    I'm not sure why exactly, but this configuration improves over basic step 1 peek and splice all by allowing logging of the server certificate (instead of just IP address), domain blocking of SSL sites via squidguard list, and provides an alternate splice operation for certain sites that for some reason cannot connect after the certificate name is captured.

    # peek at client TLS-request to get SNI
    # peek at server cert (for logging)
    # splice earlySplice at step 3 only
    acl earlySplice ssl::server_name "*.crashplan.com"
    ssl_bump peek step1
    ssl_bump peek step2 earlySplice
    ssl_bump splice step3 earlySplice
    ssl_bump splice all
    sslproxy_cert_error deny all
    
    

  • Banned

    Well yes, that will no doubt improve splice since you get whole lot more information available at steps 2/3, as explained here:
    https://github.com/pfsense/FreeBSD-ports/blob/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1539

    The above makes bumping impossible, however.

    It's not possible to do zillion variants in the GUI. Use Advanced Options, Custom ACLs (before auth).



  • The above makes bumping impossible, however.

    This is understood.  For my use case, I don't need full blown MiTM - logging the site name and simple domain blocking are sufficient.

    Right now I'm using custom ACLs for this.  It's a hack (because it supersedes the auto-generated ssl_bump directives that follow), but it works.

    It would be nice if it were available as a simple toggle in the config or if the various ssl config options were exposed for customization under 'advanced', but it works reasonably well as-is.

    Thank you for your work making this tool available!


  • Banned

    I'll see if something reasonable can be added for

    • splice everything without bump (i.e., splice all)
    • custom splice ACLs/settings (some advanced textarea burried somewhere, if you break it, your problem)

    without overcomplicating the GUI and confusing everyone.


  • Banned


  • Rebel Alliance Developer Netgate

    Looks great, we're getting that PR merged in right now, thanks!


  • Banned

    Thanks for testing/feedback. Any volunteers to fixrewrite SquidGuard now? (No, I cannot do it. Tried many times, unable to work with that code for more than a couple of minutes.)



  • e2guardian its more active…
    if you want to replace squidGuard with e2guardian i could do this!

    what you think?

    https://github.com/e2guardian/e2guardian


  • Banned

    @fabiomello:

    e2guardian its more active…
    if you want to replace squidGuard with e2guardian i could do this!

    what you think?

    https://github.com/e2guardian/e2guardian

    Hmmm… good luck.


  • Rebel Alliance Developer Netgate

    From the history there it looks like it had a similar problem to squidGuard. Whatever happens, it needs a ground-up rewrite with up-to-date style and practices all-around.


  • Banned

    Yeah. The XMLs in the linked e2guardian PR would be a good starting point to get a grip of potential feature set. The PHP code there still needs major work, though it must have been a  lot better than SquidGuard, considering I've been able to somehow finish the code style at least. :P

    The PHP-generated package XML is a major can of worms there.

    Plus note, that PR was for 2.2.x, lots of changes meanwhile.



  • Good job. Congratulations.
    Tag_none / 200 for all https and ip address is not good to appear in logs
    Do you have a solution for this problem?
    A manual DNS problem can sometimes cause the page not found error
    We continue to test this issue



Log in to reply