2

I am trying to set up SSLSplit on OSX Mavericks according to this tutorial.

I got it working on a Ubuntu Machine, so I know SSLSplit works just fine and the issue is only with packets not being forwarded to the port on which SSLSplit is listening on Mavericks. On the SSLSplit homepage it says :

SSLsplit currently supports the following operating systems and NAT engines:

Mac OS X: ipfw fwd

so I try to set up port forwarding using the following two commands, but I read somewhere that ipfw has been dropped in OSX 10.9 Mavericks.

sudo sysctl -w net.inet.ip.forwarding=1
sudo ipfw add fwd 127.0.0.1,8080 tcp from 192.168.2.2 to any 443 in via bridge100

I even tried this in OSX 10.8.5, the commands don't give any error on either operating systems but traffic is not being forwarded.

I also tried the pfctl approach as mentioned here. But with this method, I don't think SSLSplit is too happy, since I think the packet loops around, I get too many files open error and SSLSplit crashes. Can SSLSplit work with pfctl? Does it really care how traffic is forwarded to the port on which it is listening? Or does the error occur because of some misconfiguration on my part?

Has someone been able to use SSLSplit on OSX Mavericks? Can you guide me with the port forwarding part? It would be better if you could explain the entire process.

I am not using tools such as mitmproxy since I have to decrypt the SSL Layer over non-HTTP Traffic.

4

1 回答 1

3

SSLSplit 可以与 pfctl 一起使用吗？它真的关心如何将流量转发到它正在侦听的端口吗？还是由于我的一些错误配置而发生错误？

当在套接字上接收连接时，SSLsplit 需要确定连接最初的目的地，然后才被 ipfw、pf 或其他一些 NAT 机制拦截和重定向。每个 NAT 机制都要求 SSLsplit 使用不同的方法来确定原始目标地址是什么。使用 pf rdr 时，该机制就是DIOCNATLOOKioctl 接口。对于 ipfw fwd，该机制是标准getsockname()调用。如果您调用getsockname()由 pf rdr 重定向的已连接套接字，您将收到本地套接字端点，这是 sslsplit 正在侦听的 IP 地址和端口，因此会创建无限数据包循环。如果您在 ipfw fwd 转移套接字上执行此操作，您将获得原始目的地。

有人能够在 OSX Mavericks 上使用 SSLSplit 吗？你能指导我使用端口转发部分吗？

很遗憾，目前没有办法在 Mac OS X 上使 SSLsplit 支持 pf，因为Apple 似乎没有安装使用DIOCNATLOOKioctl 接口所需的头文件，并且源代码分发附带的头文件与 OpenBSD/FreeBSD 对应的头文件不同，因为 ioctl 接口略有改变并被设为私有。可以添加对 Apple 修改后的私有 ioctl 接口到 SSLsplit 的支持，但到目前为止还没有人编写代码来做到这一点。

SSLsplit 在 SNI 配置中非常有用，其中目标地址取自客户端要求的 SNI 主机名，但当然只适用于支持 SNI 的客户端。具有静态目标的配置也可以使用。

还有与 ipfw fwd 兼容的 pf 转移到，但 pf 的该功能目前在 Mac OS X pf 上不可用。

另请参阅此错误跟踪器问题：https ://github.com/droe/sslsplit/issues/15

更新： SSLsplit git master现在包括对 Mac OS X 10.7、10.8 和 10.9 上 pf 的实验性支持，这将成为即将发布的0.4.8 版本的一部分。

于 2014-01-08T15:22:40.083 回答