Please add feature - exception list

[janusloo]

Hi,

This is for a feature request: I have turned on ssl interception for my workstations and came across a minor issue: google drive refuses to connect if SSL interception is on. See the cause here.

Is it possible to add an exception list for sites that do application side SSL authentication validation? The passthrough parameter does not work at the moment.

With an exception list I can for example exclude sites and do not work properly and still can mitm other sites. Now I need to turn it on or off. It is a one for all or none for all at this time.

Thank you so much for your effort and time in this excellent software!

[sonertari]

Hi @janusloo, yes, this is an issue we have discussed here. (As we have discussed there, the passthrough option cannot solve this issue.) I think you are right, we need a solution for this.

Exception/bypass/passthrough lists may really be the correct solution, as you say. But have you come across other solutions? Please post relevant links you think may help. I am planning to work on a possible solution asap.

[janusloo]

Hi @sonertari no I did not have any success in finding other solutions to this issue. That's why I suggested to add exclusion list as a solution... unless you know another way to bypass this technical challenge?

If I found something I will definitely post it here. Thank you for looking at it.

[sonertari]

Hi @janusloo, can you try the develop branch and report back? It seems to work here.

[janusloo]

Hi @sonertari thanks for the quick fix.... I will test it when I am home and report back

[janusloo]

Hi @sonertari, i installed the develop branch but did not find any new parameters or the passthrough still doesn't work otherwise. I maybe missing something??

Thanks!

[sonertari]

I guess you are on master not develop (you can either fork/clone the repo and switch to develop branch, or go to main project page, select develop on the branch dropdown box, and Download the SSLproxy-develop.zip file). There are a couple of sample (commented out) PassSite lines at the end of sslproxy.conf file. You cannot miss it. I have updated the documentation too.

[janusloo]

Hi thanks.I have compiled and installed it. To test, I put in the following parameter in the configuration file, sslproxy.conf:

PassSite https://accounts.google.com/o/oauth2/token*

This is the Google Sync plugin I use in KeePass and it is the URL that the plugin would error out when I turned on the SSL inspection. How to use the PassSite? Do I put in the URL here or the domain name(s) of the certificate it forges? It still errors out that the web request to the URL has failed. I have PassThrough option enabled though.

Oh sslproxy will be killed by signal 11 when I put the parameter in the configuration file.

[sonertari]

You should use SNI or Common Names as PassSite paramater (not URLs). In your case for this URL, I have looked into the certificate of that site and seen that the common name is accounts.google.com. So, if this is correct, you should use the following line: PassSite accounts.google.com (do not use *).

So, you need to find the SNI and Common Names of the sites you want to pass through. If you enable the detailed debug logs of SSLproxy and start it with -D4 option, SSLproxy will tell you all such details.

Btw, I cannot reproduce the crash with that URL line in your post. That option is wrong, but it shouldn't crash SSLproxy either. Or could it be something else?

[janusloo]

Okay I followed your instructions and put accounts.google.com in PassSite but it now generated this error:
Error: TrustFailure (The authentication or decryption has failed.). And sslproxy got killed by signal 11. I don't really know what happened.

[sonertari]

This does not seem related to Passthrough or PassSite options, but related to OpenSSL. And I guess this was the same signal 11 crash you mentioned before. When I google for that error, I read that it may be related with missing trusted cert authorities. Have you installed the system from scratch (or are you using the same system as before), or somehow are you missing a trust store? If the same error happens when you disable Passthrough/PassSite options, then the issue must be really about trust store.

[sonertari]

-D4 option would be really helpful to investigate such issues. You can send such detailed logs to my e-mail address, if you want.

[janusloo]

This does not seem related to Passthrough or PassSite options, but related to OpenSSL. And I guess this was the same signal 11 crash you mentioned before. When I google for that error, I read that it may be related with missing trusted cert authorities. Have you installed the system from scratch (or are you using the same system as before), or somehow are you missing a trust store? If the same error happens when you disable Passthrough/PassSite options, then the issue must be really about trust store.

@sonertari hi you are right about missing the self-signed in the system's trust store. I added it and now the google sync authentication goes through without a hitch. The signal 11 error still occurs though.

Please see below the startup message:

SSLproxy  (built 2019-04-21)
------------------------------------------------------------------------------
WARNING: Something is wrong with the version compiled into sslproxy!
The version should contain a release number and/or a git commit reference.
If using a package, please report a bug to the distro package maintainer.
------------------------------------------------------------------------------
Build info: V:DIR N:
Features: -DHAVE_NETFILTER
NAT engines: netfilter* tproxy
netfilter: IP_TRANSPARENT IP6T_SO_ORIGINAL_DST
Local process info support: no
compiled against OpenSSL 1.1.0j  20 Nov 2018 (101000af)
rtlinked against OpenSSL 1.1.0j  20 Nov 2018 (101000af)
OpenSSL has support for TLS extensions
TLS Server Name Indication (SNI) supported
OpenSSL is thread-safe with THREADID
OpenSSL has engine support
Using SSL_MODE_RELEASE_BUFFERS
SSL/TLS protocol availability: tls10 tls11 tls12 
SSL/TLS algorithm availability: !SHA0 RSA DSA ECDSA DH ECDH EC
OpenSSL option availability: SSL_OP_NO_COMPRESSION SSL_OP_NO_TICKET SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION SSL_OP_TLS_ROLLBACK_BUG
compiled against libevent 2.1.8-stable
rtlinked against libevent 2.1.8-stable
compiled against libnet 1.1.6
rtlinked against libnet 1.1.6
compiled against libpcap n/a
rtlinked against libpcap 1.8.1
4 CPU cores detected
Generated RSA key for leaf certs.
SSL/TLS protocol: negotiate

I currently have the following openssl version installed:
openssl/stable,now 1.1.0j-1~deb9u1 armhf [installed]

Please advise. Thank you.

[janusloo]

-D4 option would be really helpful to investigate such issues. You can send such detailed logs to my e-mail address, if you want.

Yes I have debug level 4 turned on, it is the default. Before signal 11 there were only information about successfully forged certificate. No other error messages.