Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #211500

Re: HTTP shimmed to HTTPS; was Re: stunnel as transparent proxy.

Show all headers | View raw

On Wed, Jul 17, 2019 at 02:32:28PM -0700, peter@easthope.ca wrote:
> > stunnel(1) mentions helpfully that you're required to have  a certain
> > netfilter setup (mainly involving DNAT in your case), ... 
> > If you need to transform outbound HTTP requests to HTTPS to multiple
> > hosts ...
> 
> Yes, I have a Web browser capable of HTTP and not HTTPS. The immediate 
> objective is that the browser requests 
> https://en.wikipedia.org/wiki/Network_socket , for example, the 
> communication is TLS encrypted and issued to the original address.  
> The returned packets should be decrypted.  Should work for any address 
> of course but no address translation.  Shim might describe the action 
> better than proxy.

stunnel is unsuitable for such task.

>                                                                                                                                                        
> > you'll probably need squid/haproxy/nginx/whatever.
> 
> Never used any of these.  "/" means "or"?

Yes, it meant "or".
You need a specific kind of forward proxy, capable of transforming
HTTP to HTTPS (to do actual requests) and back (to send'em to a
browser).

> Shorewall is working here. If that can apply TLS, good.

No it cannot. Shorewall is a frontend to netfilter kernel subsystem.
It can do all kinds of things as long as they do not exceed L4 (as in
OSI L4, transport layer). What you want to do is to apply a
transformation to L7 (application layer), and that's something that
netfilter cannot do.

> What is the simplest package that can provide this?

For a bunch of sites - apache or nginx.
For the whole Internet - *maybe* (and that's a big one) squid can do the
job. Most probably you'll need a very creative usage of ProxHTTPSProxy
(not in Debian) or its equivalent.

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

HTTP shimmed to HTTPS; was Re: stunnel as transparent proxy. peter@easthope.ca - 2019-07-18 00:20 +0200
  Re: HTTP shimmed to HTTPS; was Re: stunnel as transparent proxy. Reco <recoverym4n@enotuniq.net> - 2019-07-18 09:20 +0200
    Re: Shimming HTTP to HTTPS. peter@easthope.ca - 2019-07-28 18:40 +0200
      Re: Shimming HTTP to HTTPS. Reco <recoverym4n@enotuniq.net> - 2019-07-28 19:00 +0200
        Re: Shimming HTTP to HTTPS. David Wright <deblis@lionunicorn.co.uk> - 2019-07-29 02:50 +0200
        Re: Shimming HTTP to HTTPS. peter@easthope.ca - 2019-08-22 18:10 +0200
          Re: Shimming HTTP to HTTPS. Reco <recoverym4n@enotuniq.net> - 2019-08-22 19:40 +0200
        Re: Shimming HTTP to HTTPS. peter@easthope.ca - 2019-08-23 19:30 +0200
      Re: Shimming HTTP to HTTPS. David Wright <deblis@lionunicorn.co.uk> - 2019-07-29 02:50 +0200
        Re: Shimming HTTP to HTTPS. Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-29 08:30 +0200
          Re: Shimming HTTP to HTTPS. David Wright <deblis@lionunicorn.co.uk> - 2019-07-29 18:50 +0200
        Re: Shimming HTTP to HTTPS. peter@easthope.ca - 2019-08-14 05:10 +0200
          Re: Shimming HTTP to HTTPS. David Wright <deblis@lionunicorn.co.uk> - 2019-08-15 00:10 +0200

csiph-web