Wireshark depends on getting all the certificates handed to it in order to decrypt traffic, so that's a completely different game. Very good for inspecting inbound SSL traffic to your own servers, pretty worthless for outbound traffic.

Think of this as a poor man's alternative to one specific feature found in Palo Alto, CheckPoint or F5. Those are the commercial product offerings I'm familar with that does SSL inspection really, really well. Better, obviously, than anything I could hope to achieve with a Perl hack.

I'm using IO::Socket::SSL::Intercept combined with SNI sniffing to clone certificates and act as a proxy between the client and the server. I didn't find this documented anywhere so in case anyone is curious, here's the trick:

# During setup
my $https = IO::Socket::SSL->new(
  Listen        => 128,
  LocalAddr     => '0.0.0.0',
  LocalPort     => 8443,
  ReuseAddr     => 1,
  SSL_startHandshake      => 0, # Don't start SSL negotiation immediat
+ely on accept()
);

# In the main loop
my $client = $https->accept(); # Just a vanilla socket for now really

# Now fork off a child process (or use threads or whatever...)
# ...

# In the child process, negotiate SSL with the client
my $client = IO::Socket::SSL->start_SSL($client,
  SSL_server    => 1,
  SSL_create_ctx_callback => \&ctx_callback, # First callback
);
# Now establish an SSL connection with the server and relay traffic in
+ plaintext.
# ...


# This callback is invoked when a new CTX has been created
sub ctx_callback {
  my $ctx = shift;
  Net::SSLeay::CTX_set_tlsext_servername_callback($ctx, \&sni_callback
+); # Second callback
}

# This callback is invoked during SSL handshake when SNI is known
sub sni_callback {
  my $ssl = shift;
  my $hostname = Net::SSLeay::get_servername($ssl);
  # Either use IO::Socket::SSL::Intercept to clone a certificate/key p
+air
  # for $hostname or re-use one that was cloned previously
  my ($cert, $key) = get_cert_key_files($hostname);
  Net::SSLeay::use_RSAPrivateKey_file($ssl, $key, &Net::SSLeay::FILETY
+PE_PEM);
  Net::SSLeay::use_certificate_file($ssl, $cert, &Net::SSLeay::FILETYP
+E_PEM);
  # From here on in, SSL handshake should complete with our cloned cer
+tificate
  # if the client has been configured to trust our CA certificate. 
  # Some services depend on their own private CA store and can't be tr
+icked.
}
[download]

The closest non-commercial product I've found is Squid, but besides being a nightmare to configure, Squid depends on the destination IP to be intact so it can make the server connection. This means DNAT is right out, you have to use either WCCP or special routing to redirect the traffic. Unfortunately, neither one is an option in my environment since the vast majority of traffic must be completely undisturbed.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.