Cannot make on Linux

[janusloo]

Hi there,

I tried to compile SSLproxy myself. With make I got the following error:

SSLproxy v0.5.4-dirty

Report bugs at https://github.com/droe/sslsplit/issues/new
Please supply this header for diagnostics when reporting build issues
Before reporting bugs, make sure to try the latest develop branch first:
% git clone -b develop https://github.com/droe/sslsplit.git

Via pkg-config: openssl libevent libevent_openssl libevent_pthreads
Build options: -DHAVE_NETFILTER
uname -a: Linux DietPi.local 4.9.77-v7+ #1081 SMP Wed Jan 17 16:15:20 GMT 2018 armv7l GNU/Linux

cc -c -isystem/usr/local/include -D_GNU_SOURCE -D"BNAME="sslproxy"" -D"PNAME="SSLproxy"" -D"VERSION="v0.5.4-dirty"" -D"BUILD_DATE="2018-02-15"" -D"FEATURES="-DHAVE_NETFILTER"" -D"BUILD_INFO="V:GIT"" -DHAVE_NETFILTER -pthread -std=c99 -Wall -Wextra -pedantic -D_FORTIFY_SOURCE=2 -fstack-protector-all -pthread -o version.o version.c
cc -L/usr/local/lib -pthread -o sslproxy cachemgr.o cachetgcrt.o logbuf.o url.o log.o cachefkcrt.o opts.o thrqueue.o pxyconn.o pxysslshut.o privsep.o logger.o nat.o base64.o version.o main.o cachessess.o util.o cache.o pxythrmgr.o dynbuf.o cert.o sys.o proxy.o proc.o ssl.o cachedsess.o -lssl -lcrypto -levent_openssl -levent_pthreads -levent
pxyconn.o: In function pxy_conn_setup': pxyconn.c:(.text+0x8d00): undefined reference to getdtablecount'
collect2: error: ld returned 1 exit status
GNUmakefile:411: recipe for target 'sslproxy' failed
make: *** [sslproxy] Error 1

For build problems, please supply:

• Output of uname -a (Linux DietPi.local 4.9.77-v7+ #1081 SMP Wed Jan 17 16:15:20 GMT 2018 armv7l GNU/Linux)
• Full output of failed make including the header (pls see above)
• Version and origin of OpenSSL used (official openssl site, version 1.1.1-pre1)
• Version and origin of libevent used (https://github.com/libevent/libevent)

I have been googling and found only information that the getdtablecount is a BSD system call function? As you can see I am compiling on Linux, not BSD. So I am really stuck here. Please help.

Thanks in advance!

[sonertari]

SSLproxy compiles with the following patch on Linux 4.13.0-16-generic #19~16.04.3-Ubuntu SMP Mon Oct 16 18:59:33 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux. Can you apply and try it, then report if SSLproxy works on Linux too?

--- a/pxyconn.c
+++ b/pxyconn.c
@@ -64,6 +64,9 @@
 #include <assert.h>
 #include <sys/param.h>
 
+#if defined(HAVE_NETFILTER) || defined(HAVE_IPFILTER)
+#include <glob.h>
+#endif
 
 /*
  * Maximum size of data to buffer per connection direction before
@@ -3587,7 +3590,30 @@
 	pxy_conn_connect(ctx);
 }
 
+#if defined(HAVE_NETFILTER) || defined(HAVE_IPFILTER)
 /*
+ * Copied from:
+ * https://github.com/tmux/tmux/blob/master/compat/getdtablecount.c
+ */
+int
+getdtablecount(void)
+{
+	char path[PATH_MAX];
+	glob_t g;
+	int	n = 0;
+
+	if (snprintf(path, sizeof path, "/proc/%ld/fd/*", (long)getpid()) < 0) {
+		log_err_level_printf(LOG_CRIT, "snprintf overflow\n");
+		return 0;
+	}
+	if (glob(path, 0, NULL, &g) == 0)
+		n = g.gl_pathc;
+	globfree(&g);
+	return n;
+}
+#endif
+
+/*
  * Callback for accept events on the socket listener bufferevent.
  * Called when a new incoming connection has been accepted.
  * Initiates the connection to the server.  The incoming connection
@@ -3605,6 +3631,8 @@
                proxyspec_t *spec, opts_t *opts,
 			   evutil_socket_t clisock)
 {
+	int dtable_count = getdtablecount();
+
 #ifdef DEBUG_PROXY
 	log_dbg_level_printf(LOG_DBG_MODE_FINEST, "pxy_conn_setup: ENTER fd=%d\n", fd);
 
@@ -3615,11 +3643,11 @@
 		free(port);
 	}
 
-	log_dbg_level_printf(LOG_DBG_MODE_FINEST, "pxy_conn_setup: descriptor_table_size=%d, current fd count=%d, reserve=%d\n", descriptor_table_size, getdtablecount(), FD_RESERVE);
+	log_dbg_level_printf(LOG_DBG_MODE_FINEST, "pxy_conn_setup: descriptor_table_size=%d, current fd count=%d, reserve=%d\n", descriptor_table_size, dtable_count, FD_RESERVE);
 #endif /* DEBUG_PROXY */
 
 	// Close the conn if we are out of file descriptors, or libevent will crash us
-	if (getdtablecount() + FD_RESERVE >= descriptor_table_size) {
+	if (dtable_count + FD_RESERVE >= descriptor_table_size) {
 		errno = EMFILE;
 		log_err_level_printf(LOG_CRIT, "Out of file descriptors\n");
 		evutil_closesocket(fd);

[janusloo]

Hi yes the patch works. I successfully compiled it on Linux. Thanks a lot!

If I want to see some features to be added in Sslproxy, how can I request them?

Thanks in advance!

[sonertari]

Good to hear that, and I hope it runs fine too. Feature suggestions are considered as issues, so you can submit them the same way as this one.

[janusloo]

Thanks. For the moment I'm just experimenting with some POC project of my own. I'm mainly interested ein how MITM works.

[sonertari]

I'll keep this issue open until someone confirms that SSLproxy runs fine on Linux.

[janusloo]

Hi SSLproxy runs just fine on Linux, even on Raspberry Pi 3 (armhd). I am running Dietpi (should work on Raspbian too). It detects and forges all certificates beautifully. I want to use it with Privoxy (content/privacy filtering) due to the lack of SSL support. SSLproxy would be a great addon for Privoxy but the mode which SSLproxy runs in is not supported by privoxy. It doesn't revert the traffic back to SSLproxy. It would be great if SSLproxy can be "plugged" into Privoxy to let it also inspect the decrypted SSL traffic. But I think it would cost a big deal of time to implement it. Curious how you make SSLproxy work with Squid and e2guardian? Maybe you can make it work with Privoxy too?

[sonertari]

@janusloo, thanks for the report, so I guess I should commit that patch now. You can find the required modifications for E2guardian under its OpenBSD ports folder at https://github.com/sonertari/UTMFW/tree/master/ports/e2guardian/patches, and for Squid at https://github.com/sonertari/UTMFW/tree/master/ports/squid/patches. POP3 and SMTP patches are also in similar locations. But there may be OpenBSD related changes among those patches, so one must review those patches carefully before applying. Naturally, one must understand the related parts of the source code of the listening program to implement the mode of operation required by SSLproxy.

[sonertari]

Commit the patch: ae69b21