-SSLPlugin provides TLS/SSL support for 3proxy. It can be used to: +Since version 0.9.7, SSL/TLS support is built into 3proxy when compiled with OpenSSL +(WITH_SSL). Previously available as SSLPlugin, the functionality is now integrated +into the main binary. The plugin line is no longer required. +SSL/TLS support can be used to:
-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_server_cert /etc/3proxy/certs/server.crt ssl_server_key /etc/3proxy/certs/server.key ssl_serv @@ -670,7 +673,6 @@ Configure clients to use https://proxy-host:3129/ as the proxy URL. Client certificate authentication (mTLS):
To require clients to authenticate with a certificate, use ssl_server_verify and provide the CA certificate:-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_server_cert /etc/3proxy/certs/server.crt ssl_server_key /etc/3proxy/certs/server.key ssl_server_ca_file /etc/3proxy/certs/ca.crt @@ -685,7 +687,6 @@ Only clients with a valid certificate signed by the CA can connect. MITM for TLS traffic inspection:
To intercept and decrypt TLS traffic, you need a CA certificate to generate spoofed server certificates:-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_server_ca_file /etc/3proxy/certs/ca.crt ssl_server_ca_key /etc/3proxy/certs/ca.key ssl_client_verify @@ -703,7 +704,6 @@ Without ssl_client_verify, the proxy is vulnerable to MITM attacks. TLS client (connect to upstream via TLS):
To connect to upstream servers via TLS with client certificate authentication:-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_client_cert /etc/3proxy/certs/client.crt ssl_client_key /etc/3proxy/certs/client.key ssl_client_verify @@ -715,7 +715,6 @@ proxy -p3128 Conditional TLS for parent proxy (ssl_client_mode 3):
With ssl_client_mode 3, TLS handshake to parent proxy is performed only if the parent type ends with 's' (secure types). This allows mixing secure and non-secure parent proxies in the same configuration:-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_server_cert /etc/3proxy/certs/server.crt ssl_server_key /etc/3proxy/certs/server.key ssl_client_mode 3 @@ -734,7 +733,7 @@ ssl_nocliThis creates an HTTPS proxy (ssl_serv) that accepts TLS connections from clients. For parent proxy connections, user1's traffic goes through an https parent with TLS encryption (secure type), while user2's traffic goes through a regular socks5 parent without TLS. Secure parent types include: tcps, https, connects, connect+s, socks4s, socks5s, socks4+s, socks5+s, pop3s, smtps, ftps.
-
Creating a Certificate Authority (CA):
For MITM or mTLS, you need a CA. Generate a CA private key and certificate:
@@ -849,6 +848,65 @@ openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
openssl pkcs12 -export -out client.p12 -passout pass: \
-inkey client.key -in client.crt -certfile ca.crt
+
+Since version 0.9.7, PCRE (Perl Compatible Regular Expressions) filtering is built into +3proxy when compiled with PCRE2 support (WITH_PCRE). Previously available as PCREPlugin, +the functionality is now integrated into the main binary. The plugin line is no longer required. +
++PCRE filtering can be used to create matching and replacement rules with regular expressions +for client requests, client and server headers, and client and server data. +
++Commands: +
+pcre TYPE FILTER_ACTION REGEXP [ACE] +pcre_rewrite TYPE FILTER_ACTION REGEXP REWRITE_EXPRESSION [ACE] +pcre_extend FILTER_ACTION [ACE] +pcre_options OPTION1 [...] ++
+
+Examples: +
+# Block requests containing specific keywords for certain users +pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16 + +# Block responses with specific content type +pcre srvheader deny "Content-type: application" + +# Replace content in both directions (censorship) +pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser +pcre_extend deny * 192.168.0.1/16 ++
+Note: Regular expressions don't require authentication and cannot replace +authentication and/or allow/deny ACLs. +
First, always specify the internal interface to accept incoming connections with the diff --git a/doc/html/howtor.html b/doc/html/howtor.html index b72935d..c2df08d 100644 --- a/doc/html/howtor.html +++ b/doc/html/howtor.html @@ -33,8 +33,9 @@
-SSLPlugin обеспечивает поддержку TLS/SSL для 3proxy. Он может использоваться для: +Начиная с версии 0.9.7 поддержка TLS/SSL встроена в 3proxy при компиляции с OpenSSL +(WITH_SSL). Ранее доступная как SSLPlugin, функциональность теперь интегрирована +в основной бинарный файл. Строка plugin больше не нужна. +TLS/SSL может использоваться для:
-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_server_cert /etc/3proxy/certs/server.crt ssl_server_key /etc/3proxy/certs/server.key ssl_serv @@ -679,7 +682,6 @@ proxy -p3128 Аутентификация по клиентскому сертификату (mTLS):
Чтобы требовать от клиентов аутентификацию по сертификату, используйте ssl_server_verify и укажите CA-сертификат:-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_server_cert /etc/3proxy/certs/server.crt ssl_server_key /etc/3proxy/certs/server.key ssl_server_ca_file /etc/3proxy/certs/ca.crt @@ -694,7 +696,6 @@ proxy -p3129 MITM для инспекции TLS-трафика:
Для перехвата и расшифровки TLS-трафика требуется CA-сертификат для генерации подделанных серверных сертификатов:-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_server_ca_file /etc/3proxy/certs/ca.crt ssl_server_ca_key /etc/3proxy/certs/ca.key ssl_client_verify @@ -712,7 +713,6 @@ CA-сертификат должен быть доверенным для кли TLS-клиент (соединение с вышестоящим сервером через TLS):
Для соединения с вышестоящими серверами через TLS с аутентификацией по клиентскому сертификату:-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_client_cert /etc/3proxy/certs/client.crt ssl_client_key /etc/3proxy/certs/client.key ssl_client_verify @@ -724,7 +724,6 @@ proxy -p3128 Условное TLS для parent прокси (ssl_client_mode 3):
При ssl_client_mode 3 TLS-рукопожатие с родительским прокси выполняется только если тип parent прокси заканчивается на 's' (защищённые типы). Это позволяет смешивать защищённые и незащищённые родительские прокси в одной конфигурации:-plugin /path/to/SSLPlugin.ld.so ssl_plugin ssl_server_cert /etc/3proxy/certs/server.crt ssl_server_key /etc/3proxy/certs/server.key ssl_client_mode 3 @@ -743,7 +742,7 @@ ssl_nocliСоздаётся HTTPS-прокси (ssl_serv), принимающий TLS-соединения от клиентов. Для соединений с родительским прокси трафик user1 идёт через https родитель с TLS-шифрованием (защищённый тип), а трафик user2 — через обычный socks5 родитель без TLS. Защищённые типы parent прокси: tcps, https, connects, connect+s, socks4s, socks5s, socks4+s, socks5+s, pop3s, smtps, ftps.
-
Создание удостоверяющего центра (CA):
Для MITM или mTLS требуется CA. Сгенерируйте закрытый ключ CA и сертификат:
@@ -859,6 +858,66 @@ openssl pkcs12 -export -out client.p12 -passout pass: \
-inkey client.key -in client.crt -certfile ca.crt
+
+Начиная с версии 0.9.7 фильтрация PCRE встроена в 3proxy при компиляции с поддержкой +PCRE2 (WITH_PCRE). Ранее доступная как PCREPlugin, функциональность теперь интегрирована +в основной бинарный файл. Строка plugin больше не нужна. +
++PCRE-фильтрация может использоваться для создания правил поиска и замены с регулярными +выражениями для запросов клиентов, заголовков клиента и сервера, а также данных. +
++Команды: +
+pcre TYPE FILTER_ACTION REGEXP [ACE] +pcre_rewrite TYPE FILTER_ACTION REGEXP REWRITE_EXPRESSION [ACE] +pcre_extend FILTER_ACTION [ACE] +pcre_options OPTION1 [...] ++
+
+Примеры: +
+# Блокировать запросы с определёнными ключевыми словами для некоторых пользователей +pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16 + +# Блокировать ответы с определённым content-type +pcre srvheader deny "Content-type: application" + +# Замена содержимого в обоих направлениях (цензура) +pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser +pcre_extend deny * 192.168.0.1/16 ++
+Примечание: Регулярные выражения не требуют авторизации и не могут заменить +авторизацию и/или ACL allow/deny. +
+
Во-первых, для ограничения доступа необходимо указать внутренний интерфейс,
diff --git a/doc/html/man5/3proxy.cfg.5.html b/doc/html/man5/3proxy.cfg.5.html
index 0a52129..4ffe168 100644
--- a/doc/html/man5/3proxy.cfg.5.html
+++ b/doc/html/man5/3proxy.cfg.5.html
@@ -10,6 +10,14 @@
NAME
DESCRIPTION
PLUGINS
+SSL/TLS SUPPORT
+MITM Commands
+Server TLS Commands
+Client TLS Commands
+SSL Parameters
+PCRE FILTERING
+PCRE Commands
+PCRE Parameters
BUGS
SEE ALSO
TRIVIA
@@ -1017,6 +1025,220 @@ the given value, no data filtering will be performed through
filtering plugins to avoid data corruption and/or
Content-Length changing. Default is 1MB (1048576).
SSL/TLS support +is built into 3proxy (since 0.9.7) when compiled with +OpenSSL (WITH_SSL). Previously available as SSLPlugin, the +functionality is now integrated into the main binary. The +plugin line is no longer required.
+ +SSL/TLS can be +used for: - transparent MITM (Man-in-the-Middle) for TLS +traffic inspection - https:// proxy (TLS-encrypted +connection between client and proxy) - TLS client +connections to upstream servers with certificate +authentication - mTLS (mutual TLS) requiring client +certificates
+ +ssl_mitm
+- spoof certificates for services started below. Usage
+without ssl_client_verify is insecure.
+ssl_nomitm - do not spoof certificates for services
+started below
ssl_serv
+(or ssl_server) - require TLS connection from clients for
+services below
+ssl_noserv (or ssl_noserver) - do not require TLS
+connection from clients for services below
ssl_cli
+(or ssl_client) - establish TLS connection to upstream
+server for services below
+ssl_nocli (or ssl_noclient) - do not establish TLS
+connection to upstream server for services below
ssl_server_cert
+/path/to/cert - Server certificate (should not be
+self-signed, must contain SAN) for ssl_serv
+ssl_server_key /path/to/key - Server certificate
+key for ssl_server_cert or generated MITM certificate
+
+ssl_client_cert /path/to/cert - Client
+certificate for authentication on upstream server (used with
+ssl_cli)
+ssl_client_key /path/to/key - Client certificate
+key for ssl_client_cert
+ssl_client_ciphersuites ciphersuites_list - TLS
+client ciphers for TLS 1.3
+ssl_server_ciphersuites ciphersuites_list - TLS
+server ciphers for TLS 1.3
+ssl_client_cipher_list ciphers_list - TLS client
+ciphers for TLS 1.2 and below
+ssl_server_cipher_list ciphers_list - TLS server
+ciphers for TLS 1.2 and below
+ssl_client_min_proto_version tls_version - TLS
+client minimum TLS version (e.g., TLSv1.2)
+ssl_server_min_proto_version tls_version - TLS
+server minimum TLS version
+ssl_client_max_proto_version tls_version - TLS
+client maximum TLS version
+ssl_server_max_proto_version tls_version - TLS
+server maximum TLS version
+ssl_client_verify - verify the certificate for the
+upstream server (used with ssl_mitm or ssl_cli)
+ssl_client_no_verify - do not verify the certificate for
+the upstream server (default)
+ssl_server_verify - require client certificate
+authentication (mTLS) for ssl_serv
+ssl_server_no_verify - do not require client certificate
+(default)
+ssl_server_ca_file /path/to/cafile - CA
+certificate file for MITM
+ssl_server_ca_key /path/to/cakey - key for
+ssl_server_ca_file MITM CA
+ssl_server_ca_dir /path/to/cadir - CA directory
+for ssl_server_verify
+ssl_server_ca_store /path/to/castore - CA store
+for ssl_server_verify (OpenSSL 3.0+)
+ssl_client_ca_file /path/to/cafile - CA file for
+ssl_client_verify
+ssl_client_ca_dir /path/to/cadir - CA directory
+for ssl_client_verify
+ssl_client_ca_store /path/to/castore - CA store
+for ssl_client_verify (OpenSSL 3.0+)
+ssl_client_sni hostname - SNI hostname to send to
+upstream server
+ssl_client_alpn protocol1 protocol2 ... - ALPN
+protocols to negotiate with upstream server
+ssl_client_mode mode - when to establish TLS
+connection: 0 - on connect (default), 1 - after
+authentication, 2 - before data, 3 - only for secure parent
+types (ending with ’s’)
+ssl_certcache /path/to/cache/ - location for the
+generated MITM certificates cache
PCRE (Perl +Compatible Regular Expressions) filtering is built into +3proxy (since 0.9.7) when compiled with PCRE2 support +(WITH_PCRE). Previously available as PCREPlugin, the +functionality is now integrated into the main binary. The +plugin line is no longer required.
+ +PCRE filtering +allows creating matching and replacement rules with regular +expressions for client requests, headers, and data.
+ +pcre
+TYPE FILTER_ACTION REGEXP [ACE]
+Apply a rule for matching regular expression.
+pcre_rewrite TYPE FILTER_ACTION REGEXP
+REWRITE_EXPRESSION [ACE]
+Match and replace with rewrite expression.
+pcre_extend FILTER_ACTION [ACE]
+Extend the ACL of the last pcre or pcre_rewrite command by
+adding an additional ACE.
+pcre_options OPTION1 [OPTION2 ...]
+Set matching options. Both PCRE2 native options and PCRE
+compatibility options are supported. PCRE options are mapped
+to their PCRE2 equivalents for backward compatibility.
+PCRE2 options: PCRE2_CASELESS, PCRE2_MULTILINE,
+PCRE2_DOTALL, PCRE2_EXTENDED, PCRE2_DOLLAR_ENDONLY,
+PCRE2_UNGREEDY, PCRE2_UTF, PCRE2_UCP, PCRE2_NO_AUTO_CAPTURE,
+PCRE2_FIRSTLINE, PCRE2_DUPNAMES, PCRE2_MATCH_UNSET_BACKREF,
+PCRE2_ALT_BSUX, PCRE2_ALT_CIRCUMFLEX, PCRE2_ALT_VERBNAMES,
+PCRE2_USE_OFFSET_LIMIT, PCRE2_EXTENDED_MORE, PCRE2_LITERAL,
+PCRE2_MATCH_INVALID_UTF.
+PCRE compatibility options: PCRE_CASELESS, PCRE_MULTILINE,
+PCRE_DOTALL, PCRE_EXTENDED, PCRE_ANCHORED,
+PCRE_DOLLAR_ENDONLY, PCRE_EXTRA, PCRE_NOTBOL, PCRE_NOTEOL,
+PCRE_UNGREEDY, PCRE_NOTEMPTY, PCRE_UTF8,
+PCRE_NO_AUTO_CAPTURE, PCRE_NO_UTF8_CHECK, PCRE_AUTO_CALLOUT,
+PCRE_PARTIAL, PCRE_DFA_SHORTEST, PCRE_DFA_RESTART,
+PCRE_FIRSTLINE, PCRE_DUPNAMES, PCRE_NEWLINE_CR,
+PCRE_NEWLINE_LF, PCRE_NEWLINE_CRLF, PCRE_NEWLINE_ANY,
+PCRE_NEWLINE_ANYCRLF, PCRE_BSR_ANYCRLF,
+PCRE_BSR_UNICODE.
TYPE - type of
+filtered data (comma-delimited list):
+request - content of the client’s request (e.g., HTTP
+GET request string)
+cliheader - content of the client request headers
+srvheader - content of the server’s reply headers
+clidata - data received from the client (e.g., HTTP POST
+data)
+srvdata - data received from the server (e.g., HTML
+page)
FILTER_ACTION -
+action on match:
+allow - allow this request without checking the rest of the
+rules
+deny - deny this request without checking the rest of the
+rules
+dunno - continue with the rest of the rules (useful with
+pcre_rewrite)
REGEXP - PCRE +(Perl) regular expression. Use * if no regexp matching is +required.
+ + +REWRITE_EXPRESSION +- substitution string. May contain Perl-style substrings $1, +$2, etc. $0 means the whole matched string. \r and \n may be +used to insert new lines; the string may be empty +("").
+ +ACE - access +control entry (user names, source IPs, destination IPs, +ports, etc.), identical to allow/deny/bandlimin commands. +The regular expression is only matched if the ACL matches +the connection data. Warning: Regular expressions +don’t require authentication and cannot replace +authentication and/or allow/deny ACLs.
+Note: Since version 0.9.7, PCRE filtering is built into 3proxy and does not require +a separate plugin. All pcre_* commands are available directly when 3proxy is compiled with +PCRE2 support (WITH_PCRE). The plugin line is no longer needed.
-This filtering plugin can be used to create matching and replacement +This filtering functionality can be used to create matching and replacement rules with regular expressions for client requests, client and server headers, and client and server data. It adds 3 additional -configuration commands: +configuration commands:
pcre TYPE FILTER_ACTION REGEXP [ACE] @@ -78,16 +81,10 @@ authentication and/or allow/deny ACLs.Example:
-plugin PCREPlugin.dll pcre_plugin pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16 pcre srvheader deny "Content-type: application" pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser pcre_extend deny * 192.168.0.1/16-Download:
-
Примечание: Начиная с версии 0.9.7 фильтрация PCRE встроена в 3proxy и не требует +отдельного плагина. Все команды pcre_* доступны напрямую при компиляции 3proxy с поддержкой +PCRE2 (WITH_PCRE). Строка plugin больше не нужна.
+ +Фильтрующий плагин используется для создания правил поиска и замены регулярных выражений в запросе, заголовков запроса и ответа и данных. -Добавляет поддержку 3х новых команд в файле конфигурации: +Добавляет поддержку 3х новых команд в файле конфигурации:
pcre TYPE FILTER_ACTION REGEXP [ACE] @@ -30,7 +34,7 @@ PCRE_UTF8, PCRE_NO_AUTO_CAPTURE, PCRE_NO_UTF8_CHECK, PCRE_AUTO_CALLOUT, -PCRE_PARTIAL, +PCRE_PARTIAL, PCRE_DFA_SHORTEST, PCRE_DFA_RESTART, PCRE_FIRSTLINE, @@ -58,7 +62,7 @@ PCRE_BSR_UNICODE
-plugin PCREPlugin.dll pcre_plugin pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16 pcre srvheader deny "Content-type: application" pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser pcre_extend deny * 192.168.0.1/16-
Note: Since version 0.9.7, SSL/TLS support is built into 3proxy and does not require +a separate plugin. All ssl_* commands are available directly when 3proxy is compiled with +OpenSSL support (WITH_SSL). The plugin line is no longer needed.
+ +SSL/TLS support can be used to transparently decrypt SSL/TLS data, provide TLS encryption +for proxy traffic, and authenticate using client certificates.
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_server_ca_file /path/to/cafile ssl_server_ca_key /path/to/cakey ssl_mitm @@ -67,7 +71,6 @@ MITM's traffic with a spoofed certificate for the port 3128 proxy.https:// proxy example:
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_server_cert path_to_cert ssl_server_key path_to_key ssl_serv @@ -79,7 +82,6 @@ Creates an https:// proxy on port 33128 and an http:// proxy on port 3128TLS client example (connect to upstream via TLS):
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_client_cert /path/to/client.crt ssl_client_key /path/to/client.key ssl_client_verify @@ -91,7 +93,6 @@ Creates an HTTP proxy that connects to upstream servers via TLS with client certConditional TLS for parent proxy (ssl_client_mode 3):
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_server_cert /path/to/server.crt ssl_server_key /path/to/key ssl_client_mode 3 @@ -111,7 +112,6 @@ Creates an HTTP proxy on port 3128 that uses TLS for client connections (ssl_sermTLS example (require client certificate):
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_server_cert /path/to/server.crt ssl_server_key /path/to/server.key ssl_server_ca_file /path/to/ca.crt diff --git a/doc/html/plugins/SSLPlugin.ru.html b/doc/html/plugins/SSLPlugin.ru.html index 7c6bf6b..dc9238b 100644 --- a/doc/html/plugins/SSLPlugin.ru.html +++ b/doc/html/plugins/SSLPlugin.ru.html @@ -1,6 +1,10 @@ -3proxy SSL/TLS плагин
+3proxy SSL/TLS поддержка
-Плагин можно использовать для перехвата и дешифровки SSL/TLS трафика, для шифрования трафика прокси-сервера и аутентификации с помощью клиентских сертификатов. +Примечание: Начиная с версии 0.9.7 поддержка SSL/TLS встроена в 3proxy и не требует +отдельного плагина. Все команды ssl_* доступны напрямую при компиляции 3proxy с поддержкой +OpenSSL (WITH_SSL). Строка plugin больше не нужна.
+ +Плагин можно использовать для перехвата и дешифровки SSL/TLS трафика, для шифрования трафика прокси-сервера и аутентификации с помощью клиентских сертификатов.
Для прозрачного перехвата трафика (MITM):
@@ -52,7 +56,6 @@ ssl_server_ca_key и ssl_server_key соответственно, если онПример MITM:
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_server_ca_file /path/to/cafile ssl_server_ca_key /path/to/cakey ssl_mitm @@ -64,7 +67,6 @@ proxy -p3129Пример конфигурации https:// прокси:
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_server_cert path_to_cert ssl_server_key path_to_key ssl_serv @@ -76,7 +78,6 @@ proxy -p3128Пример TLS-клиента (соединение к вышестоящему серверу через TLS):
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_client_cert /path/to/client.crt ssl_client_key /path/to/client.key ssl_client_verify @@ -88,7 +89,6 @@ proxy -p3128Условное TLS для parent прокси (ssl_client_mode 3):
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_server_cert /path/to/server.crt ssl_server_key /path/to/key ssl_client_mode 3 @@ -108,7 +108,6 @@ ssl_nocliПример mTLS (требование клиентского сертификата):
-plugin /path/to/SSLPlugin.so ssl_plugin ssl_server_cert /path/to/server.crt ssl_server_key /path/to/server.key ssl_server_ca_file /path/to/ca.crt diff --git a/man/3proxy.cfg.5 b/man/3proxy.cfg.5 index 7812e57..3b4029f 100644 --- a/man/3proxy.cfg.5 +++ b/man/3proxy.cfg.5 @@ -1135,7 +1135,7 @@ memory shortage, you can try to experiment with negative values. \fI\fR \fI \fR [\fI \fR ...] .br Loads specified library and calls given export function with given arguments, -as +as .br int functions_to_call(struct pluginlink * pl, int argc, char * argv[]); .br @@ -1149,6 +1149,203 @@ as data filtering will be performed through filtering plugins to avoid data corruption and/or Content-Length changing. Default is 1MB (1048576). +.SH SSL/TLS SUPPORT +SSL/TLS support is built into 3proxy (since 0.9.7) when compiled with OpenSSL +(WITH_SSL). Previously available as SSLPlugin, the functionality is now integrated +into the main binary. The plugin line is no longer required. + +SSL/TLS can be used for: +- transparent MITM (Man-in-the-Middle) for TLS traffic inspection +- https:// proxy (TLS-encrypted connection between client and proxy) +- TLS client connections to upstream servers with certificate authentication +- mTLS (mutual TLS) requiring client certificates + +.SS MITM Commands +.br +.BR ssl_mitm +- spoof certificates for services started below. Usage without ssl_client_verify is insecure. +.br +.BR ssl_nomitm +- do not spoof certificates for services started below + +.SS Server TLS Commands +.br +.BR ssl_serv +(or ssl_server) - require TLS connection from clients for services below +.br +.BR ssl_noserv +(or ssl_noserver) - do not require TLS connection from clients for services below + +.SS Client TLS Commands +.br +.BR ssl_cli +(or ssl_client) - establish TLS connection to upstream server for services below +.br +.BR ssl_nocli +(or ssl_noclient) - do not establish TLS connection to upstream server for services below + +.SS SSL Parameters +.br +.BR ssl_server_cert +\fI/path/to/cert\fR - Server certificate (should not be self-signed, must contain SAN) for ssl_serv +.br +.BR ssl_server_key +\fI/path/to/key\fR - Server certificate key for ssl_server_cert or generated MITM certificate +.br +.BR ssl_client_cert +\fI/path/to/cert\fR - Client certificate for authentication on upstream server (used with ssl_cli) +.br +.BR ssl_client_key +\fI/path/to/key\fR - Client certificate key for ssl_client_cert +.br +.BR ssl_client_ciphersuites +\fIciphersuites_list\fR - TLS client ciphers for TLS 1.3 +.br +.BR ssl_server_ciphersuites +\fIciphersuites_list\fR - TLS server ciphers for TLS 1.3 +.br +.BR ssl_client_cipher_list +\fIciphers_list\fR - TLS client ciphers for TLS 1.2 and below +.br +.BR ssl_server_cipher_list +\fIciphers_list\fR - TLS server ciphers for TLS 1.2 and below +.br +.BR ssl_client_min_proto_version +\fItls_version\fR - TLS client minimum TLS version (e.g., TLSv1.2) +.br +.BR ssl_server_min_proto_version +\fItls_version\fR - TLS server minimum TLS version +.br +.BR ssl_client_max_proto_version +\fItls_version\fR - TLS client maximum TLS version +.br +.BR ssl_server_max_proto_version +\fItls_version\fR - TLS server maximum TLS version +.br +.BR ssl_client_verify +- verify the certificate for the upstream server (used with ssl_mitm or ssl_cli) +.br +.BR ssl_client_no_verify +- do not verify the certificate for the upstream server (default) +.br +.BR ssl_server_verify +- require client certificate authentication (mTLS) for ssl_serv +.br +.BR ssl_server_no_verify +- do not require client certificate (default) +.br +.BR ssl_server_ca_file +\fI/path/to/cafile\fR - CA certificate file for MITM +.br +.BR ssl_server_ca_key +\fI/path/to/cakey\fR - key for ssl_server_ca_file MITM CA +.br +.BR ssl_server_ca_dir +\fI/path/to/cadir\fR - CA directory for ssl_server_verify +.br +.BR ssl_server_ca_store +\fI/path/to/castore\fR - CA store for ssl_server_verify (OpenSSL 3.0+) +.br +.BR ssl_client_ca_file +\fI/path/to/cafile\fR - CA file for ssl_client_verify +.br +.BR ssl_client_ca_dir +\fI/path/to/cadir\fR - CA directory for ssl_client_verify +.br +.BR ssl_client_ca_store +\fI/path/to/castore\fR - CA store for ssl_client_verify (OpenSSL 3.0+) +.br +.BR ssl_client_sni +\fIhostname\fR - SNI hostname to send to upstream server +.br +.BR ssl_client_alpn +\fIprotocol1 protocol2 ...\fR - ALPN protocols to negotiate with upstream server +.br +.BR ssl_client_mode +\fImode\fR - when to establish TLS connection: 0 - on connect (default), 1 - after authentication, 2 - before data, 3 - only for secure parent types (ending with 's') +.br +.BR ssl_certcache +\fI/path/to/cache/\fR - location for the generated MITM certificates cache + +.SH PCRE FILTERING +PCRE (Perl Compatible Regular Expressions) filtering is built into 3proxy +(since 0.9.7) when compiled with PCRE2 support (WITH_PCRE). Previously +available as PCREPlugin, the functionality is now integrated into the main +binary. The plugin line is no longer required. + +PCRE filtering allows creating matching and replacement rules with regular +expressions for client requests, headers, and data. + +.SS PCRE Commands +.br +.BR pcre +\fITYPE FILTER_ACTION REGEXP [ACE]\fR +.br +Apply a rule for matching regular expression. +.br +.BR pcre_rewrite +\fITYPE FILTER_ACTION REGEXP REWRITE_EXPRESSION [ACE]\fR +.br +Match and replace with rewrite expression. +.br +.BR pcre_extend +\fIFILTER_ACTION [ACE]\fR +.br +Extend the ACL of the last pcre or pcre_rewrite command by adding an additional ACE. +.br +.BR pcre_options +\fIOPTION1 [OPTION2 ...]\fR +.br +Set matching options. Both PCRE2 native options and PCRE compatibility options +are supported. PCRE options are mapped to their PCRE2 equivalents for backward +compatibility. +.br +PCRE2 options: PCRE2_CASELESS, PCRE2_MULTILINE, PCRE2_DOTALL, PCRE2_EXTENDED, +PCRE2_DOLLAR_ENDONLY, PCRE2_UNGREEDY, PCRE2_UTF, PCRE2_UCP, PCRE2_NO_AUTO_CAPTURE, +PCRE2_FIRSTLINE, PCRE2_DUPNAMES, PCRE2_MATCH_UNSET_BACKREF, PCRE2_ALT_BSUX, +PCRE2_ALT_CIRCUMFLEX, PCRE2_ALT_VERBNAMES, PCRE2_USE_OFFSET_LIMIT, PCRE2_EXTENDED_MORE, +PCRE2_LITERAL, PCRE2_MATCH_INVALID_UTF. +.br +PCRE compatibility options: PCRE_CASELESS, PCRE_MULTILINE, PCRE_DOTALL, PCRE_EXTENDED, +PCRE_ANCHORED, PCRE_DOLLAR_ENDONLY, PCRE_EXTRA, PCRE_NOTBOL, PCRE_NOTEOL, PCRE_UNGREEDY, +PCRE_NOTEMPTY, PCRE_UTF8, PCRE_NO_AUTO_CAPTURE, PCRE_NO_UTF8_CHECK, PCRE_AUTO_CALLOUT, +PCRE_PARTIAL, PCRE_DFA_SHORTEST, PCRE_DFA_RESTART, PCRE_FIRSTLINE, PCRE_DUPNAMES, +PCRE_NEWLINE_CR, PCRE_NEWLINE_LF, PCRE_NEWLINE_CRLF, PCRE_NEWLINE_ANY, PCRE_NEWLINE_ANYCRLF, +PCRE_BSR_ANYCRLF, PCRE_BSR_UNICODE. + +.SS PCRE Parameters +TYPE - type of filtered data (comma-delimited list): +.br + request - content of the client's request (e.g., HTTP GET request string) +.br + cliheader - content of the client request headers +.br + srvheader - content of the server's reply headers +.br + clidata - data received from the client (e.g., HTTP POST data) +.br + srvdata - data received from the server (e.g., HTML page) + +FILTER_ACTION - action on match: +.br + allow - allow this request without checking the rest of the rules +.br + deny - deny this request without checking the rest of the rules +.br + dunno - continue with the rest of the rules (useful with pcre_rewrite) + +REGEXP - PCRE (Perl) regular expression. Use * if no regexp matching is required. + +REWRITE_EXPRESSION - substitution string. May contain Perl-style substrings +$1, $2, etc. $0 means the whole matched string. \er and \en may be used +to insert new lines; the string may be empty (""). + +ACE - access control entry (user names, source IPs, destination IPs, ports, etc.), +identical to allow/deny/bandlimin commands. The regular expression is only +matched if the ACL matches the connection data. +Warning: Regular expressions don't require authentication and cannot replace +authentication and/or allow/deny ACLs. + .SH BUGS Report all bugs to .BR 3proxy@3proxy.org