Project

General

Profile

Actions

Feature #2513

open

Task #4122: tracking: handle various TLS decrypt headers in proxies and decryption tools

Suricata read the SSLProxy header

Added by Marco Silva over 3 years ago. Updated 11 months ago.

Status:
Feedback
Priority:
Normal
Target version:
Effort:
medium
Difficulty:
medium
Label:

Description

Hello. is it possible to implement in the suricata for it to read the SSLProxy header to get the source and destination correctly?

UTMFW supports the deep SSL inspection of HTTP, POP3, and SMTP protocols. SSL / TLS encrypted traffic is decrypted by SSLproxy and fed into the UTM services: Web Filter, HTTP Proxy, POP3 Proxy, SMTP Proxy, Virus Scanner, Spam Filter, and Inline IPS.

https://github.com/sonertari/SSLproxy

https://github.com/sonertari/UTMFW


Files

log.pcap (11.1 KB) log.pcap pcap SSLproxy header Marco Silva, 03/07/2019 09:05 PM
log3.pcap (24.7 KB) log3.pcap pcap SSLproxy header Marco Silva, 03/07/2019 09:05 PM
log4.pcap (14.9 KB) log4.pcap pcap SSLproxy header Marco Silva, 03/07/2019 09:05 PM
Actions #1

Updated by Jason Ish over 3 years ago

  • Assignee changed from Jason Ish to OISF Dev
  • Effort set to medium
  • Difficulty set to medium
Actions #2

Updated by Andreas Herz over 3 years ago

  • Project changed from Suricata-Update to Suricata
  • Target version set to TBD
Actions #3

Updated by Victor Julien over 3 years ago

  • Assignee changed from OISF Dev to Anonymous
Actions #4

Updated by Victor Julien over 2 years ago

  • Status changed from New to Feedback

What is the header name and format? Can you add some examples?

Actions #5

Updated by Andreas Herz over 2 years ago

  • Assignee set to Community Ticket
Actions #6

Updated by Marco Silva over 2 years ago

Victor Julien wrote:

What is the header name and format? Can you add some examples?

A sample line SSLproxy inserts into the first packet in the connection is the following:

SSLproxy: [127.0.0.1]:34649,[192.168.3.24]:47286,[192.168.111.130]:443,s

Header HTTPS Connection:

GET /pagead/gen_204?id=wfocus&gqid&qqid=CLPmw9v5vNsCFdZHhgod9kUO1A&fg=1 HTTP/1.1
SSLproxy: [127.0.0.1]:31165,[172.16.103.11]:45466,[172.217.30.2]:443,s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: */*
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Referer: https://tpc.googlesyndication.com/safeframe/1-0-27/html/container.html
Cookie: IDE=AHWqTUmQsnYSkcFFQjeBSCtBQjykn62o5XiRzud06vFOVJnOHqiqe1F4lZWIXyRj;
Host: googleads.g.doubleclick.net
Via: squid/3.5.26-20170702-r14182
Cache-Control: max-age=0
Connection: keep-alive

More information:
https://github.com/sonertari/SSLproxy

Actions #7

Updated by Marco Silva over 2 years ago

Victor Julien wrote:

What is the header name and format? Can you add some examples?

Actions #8

Updated by Victor Julien 11 months ago

  • Parent task set to #4122
Actions

Also available in: Atom PDF