Bypass Proxy

Comment passer outre un proxy (mal configuré)

Background

L'article Tunneling SSL Through a WWW Proxy dont une copie est visible sur Bypass Proxy reference

Introduction: Cela marche-t-il sur mon proxy?

La première chose à faire est de voir si vous pouvez passer manuellement à travers votre proxy.
Après, on verra comment "automatiser" et crypter la méthode si ça marche (qqs scripts faits pour vous attendent)
Lorsque Mozilla se connecte à un serveur https à travers un proxy, il fait exactement la même chose que ce que nous allons utiliser: il emploie une commande CONNECT cf l'article donné comme background pour une description + complète.
Essayez:

telnet <proxy-server> <port du proxy>

puis (attention, frappe à l'aveugle...)

CONNECT www.bxlug.be:80 HTTP/1.0
1 return ou +

puis si ca marche le proxy renverra une chaîne style

HTTP/1.0 200 Connection established
Proxy-Agent: firewall wwwd

et là vous accédez de facon normale au service, exemple ici:

GET / HTTP/1.0
1 return ou +

Et vous pouvez tester ainsi le service que vous désirez, par exemple:

CONNECT www.teuwen.org:22 HTTP/1.0
->
HTTP/1.0 200 Connection established
Proxy-Agent: firewall wwwd
SSH-2.0-OpenSSH_3.4p1 Debian 1:3.4p1-1

Vous pouvez aussi recevoir un truc style

HTTP/1.0 407 Proxy-Auth
Proxy-Authenticate: Basic realm=proxy
Server: CSM Proxy Server
PROXY AUTHORIZATION ERROR
[etc]

si vous devez vous identifier à votre proxy.
Dans ce cas, un truc qui fonctionne parfois est de d'abord sortir sur le Net avec votre browser IE qui s'identifiera façon NT si le proxy est M$.
Le proxy vous reconnaîtra alors par après pour qqs temps.
Sinon, vous devez inclure une string d'identification avec la commande CONNECT mais c'est déjà plus complexe.
A la main, à part l'auth basique en base64, je ne vois pas trop, les autres sont un peu trop complexes pour se faire manuellement.

CONNECT host:port HTTP/1.0
Proxy-Authorization: basic dXNlcjpwYXNzd29yZA==

Où la string dXNlcjpwYXNzd29yZA== a été obtenue par

echo -n "user:password" |base64-encode
(package mime-codecs dans la Debian, d'autres utils existent aussi)

Si le proxy est bien configuré il ne devrait pas vous laisser passer sur n'importe quel port comme je le fais mais uniquement sur les ports pour les services sous TLS/SSL: https:443 imaps:993 ...
Dans ce cas vous devrez mettre votre ssh par exemple sur un tel port.
PS: Vous pouvez employer netcat au lieu de telnet, vous verrez ce que vous taperez, ca peut aider...
Bon hack!

Utilisation de SSH à travers un proxy

Installez ce script dans par exemple /usr/local/bin/ssh-tunnel.pl

#! /usr/bin/perl
#
# ssh-tunnel.pl
#
# Usage: ssh-tunnel.pl ssl-proxy port destination_host port
# Run it alone to get a list of options
#
# This script can be used by ssh as a "ProxyCommand" to
# traverse a www-proxy/firewall that supports the http CONNECT
# command described in
# http://home.netscape.com/newsref/std/tunneling_ssl.html
#
# For basic authentication support, see
# http://www.zvon.org/tmRFC/RFC2617/Output/chapter2.html
# "To receive authorization, the client sends the userid and password,
# separated by a single colon (":") character, within a base64 encoded
# string in the credentials"
# Ex:  echo -n "user:password" |base64-encode -> dXNlcjpwYXNzd29yZA==
#
# Example, connect to host named "remote" outside of your firewall:
# $ ssh remote -o'ProxyCommand ssh-tunnel.pl www-proxy 80 remote 22'
#
# Better yet, insert the ProxyCommand definition for host "remote" in
# your $HOME/.ssh/config file:
#
#      .
#      .
#    Host remote
#      ProxyCommand /usr/local/bin/ssh-tunnel.pl www-proxy 80 %h %p
#      .
#      .
#
# Written by Urban Kaveus <urban@statt.ericsson.se>
# Posted by Urban Kaveus to newsgroup comp.security.ssh on 23 Jan 1997.

# twa>>
# Config file format should be the following (located at ~/.ssh/proxy.conf)
# [option-section]
#   debug   = 0
#   dry     = 0
#   timeout = 1
# [proxy-section]
#   12.34/16 proxy1:8080
#   56.78.91/24 proxy2:80 user password
#
#   where the first column will be used as filter on the beginning of the
#   default gateway IP address, the second is the proxy of the network
#   and the last ones (optional) are user/pwd for the proxy.
#   To enable autoselection feature, insert the ProxyCommand in ~/.ssh/config
#   as following:
#   	ProxyCommand /usr/local/bin/ssh-tunnel.pl - - %h %p
#   To enable a different port number for direct connection,
#   use a proxy port prefixed by a ':'
#   	ProxyCommand /usr/local/bin/ssh-tunnel.pl - :8123 %h %p
#
# Revisions:
# - Add automatic proxy detection based on gateway IP Address & config file.
# - Add STDERR logging of proxy connection messages.
# - Acquire gateway instead of current IP address.
#
# Version 5:
# - Check if destination is reachable before detecting proxy.
# - Add support to a different port number for direct connection.
#
# Version 6:
# - Add 'use strict' and declare variables.
# - Add subroutine 'reachable'.
# - Select proxy only if reachable. Config file with multiple proxies is
#   possible.
#
# Version 7:
# - Check only the port of service (destport or proxyport) in subroutine
#   reachable.
#
# Version 8:
# - Add debug & dry options/mode and timeout option.
# - Test destination only if a proxy match is found and record the result.
#
# Version 9:
# - Ignore signal HUP for proper exit of parent and child processes.
# - Add detection of a local destination IP address with update of
#   destination port.
#
# Version 10:
# - Improve subnet specification/selection.
# - Add options section to proxy configuration file.
#
# Version 11:
# - Add support for basic proxy authentication
# - Add option -f to force usage of the proxy
#
# twa<<
use strict;
use Socket;
use Getopt::Long;
use MIME::Base64;

# Usage
sub usage {
    print STDERR "Usage: $0 ssl-proxy port destination port\n";
	print STDERR "Options:\n";
	print STDERR " -d, --debug           ".
		"enable and increment debug level.\n";
	print STDERR " -n, --dry             ".
		"show selection steps, do not connect.\n";
	print STDERR " -t, --timeout=TIME    ".
		"set ping timeout in seconds.\n";
	print STDERR " -i, --icmp            ".
		"enable also ICMP ping (default: tcp only)\n";
	print STDERR " -u, --user=USER       ".
		"enable basic authentication against proxy: user\n";
	print STDERR " -p, --pass=PASSWORD   ".
		"enable basic authentication against proxy: password\n";
	print STDERR " -f, --forceproxy      ".
		"force going through proxy even if directly reachable\n";
    exit(1);
}

# twa>>
# Initialize variables.
my $debug =			0;
my $dry =			0;
my $icmp =			0;
my $timeout =		1;
my $proxyuser =		"";
my $proxypass =		"";
my $proxyauth =		"";
my $authlog =		"";
my $forceproxy =	0;
my $logcount =		20;
my $logfile =		$ENV{HOME}.'/.ssh/proxy.log';
my $confile =		$ENV{HOME}.'/.ssh/proxy.conf';

# Read configuration file, if any, and process option section.
if ( open (my $fh,$confile) ) {
	while(<$fh>) {
		next if m/^$/ || m/^#/;
		last if m/section/i && m/proxy/i;
		next unless m/=/;
		s/^[ \t]*//;
		eval "\$$_";
	}
	close($fh);
}

# Parse command line options, if any.
GetOptions ( "d|debug+" => \$debug,
			 "n|dry" => \$dry,
			 "i|icmp" => \$icmp,
			 "t|timeout=i" => \$timeout,
			 "u|user=s" => \$proxyuser,
			 "p|pass=s" => \$proxypass,
			 "f|forceproxy" => \$forceproxy ) || usage();

# Compute proxy authentication, if required.
$proxyauth = encode_base64($proxyuser.':'.$proxypass) if $proxyuser;
$authlog = " with auth token $proxyauth" if $proxyauth;

# Parse command line arguments
if ( $#ARGV < 3 ) {
	print STDERR "Missing arguments\n";
	usage();
}
my $sslproxy    = shift;
my $proxyport   = shift;
my $destination = shift;
my $destport    = shift;

# Get gateway IP address.
my $gateway = getgateway() || '127.0.0.1';

# Auto-selection enabled: detecting proxy value.
if ( $sslproxy =~ m/^-/ ) {
	print STDERR "$gateway: Proxy auto-selection...\n" if $debug;
	$sslproxy = 'direct-def'; # Set default in case of no match.

	if ( $proxyport =~ m/^:/ ) {
		if ( my $hbn = gethostbyname($destination) ) {
			my $ipaddr = inet_ntoa(scalar $hbn );
			if ( isPrivateNet($ipaddr) ) {
				$proxyport =~ s/^://;
				print STDERR "Local destination[$ipaddr], ".
					"modify dstport to $proxyport\n"
					if $debug > 1;
				$destport = $proxyport;
			}
		}
	}

	# Parse configuration file.
	my $try_ping = 1;
	open (my $fh,$confile) ||
		die "Cannot open file $confile: $!\n";

	# Skip section up to proxies.
	while(<$fh>) {
		next if m/^$/ || m/^#/;
		last if m/section/i && m/proxy/i;
	}
	# Process proxy section.
	while(<$fh>) {
		next if m/^$/ || m/^#/;
		my @list = split;

		# Check if subnet match.
		next unless isInNet($gateway,$list[0]);

		# Found one match, detecting if proxy is required:
		my ($proxy,$port) = split(/:/,$list[1]);
		print STDERR "Found a match: $proxy:$port\n" if $debug > 1;
		# Check once if directly accessible.
		if (! $forceproxy && $try_ping && reachable($destination,$destport)) {
			print STDERR "But $destination:$destport seems directly ".
				"accessible, let's go direct\n" if $debug > 1;
			$sslproxy = 'direct';
			last;
		} else {
			$try_ping = 0;
			# Test if proxy is alive/reachable.
			next unless reachable($proxy,$port);
			print STDERR "And we can ping the proxy, good!\n" if $debug > 1;
			$sslproxy = $proxy;
			$proxyport = $port;

			# Check if proxy authentication is required.
			if ($list[2]) {
				$proxyuser = $list[2];
				$proxypass = $list[3] if $list[3];
				$proxyauth = encode_base64($proxyuser.':'.$proxypass);
				$authlog = " with auth token $proxyauth";
			}
			# Log connections.
			tunnel_log("$gateway: PROXY connect to $destination:$destport",
					   "via $sslproxy:$proxyport".$authlog);
			last;
		}
	}
	close($fh);
}
# Auto-selection enabled: direct connection is possible.
if ( $sslproxy =~ m/^direct/ ) {
	my $direct = 'DIRECT';
	$direct = 'DEFAULT' if $sslproxy =~ m/^direct-def/;
	print STDERR "Nothing relevant, let's try direct\n"
		if $debug > 1 && $sslproxy =~ m/^direct-def/;
	$sslproxy = $destination;
	$proxyport = $destport;

	# Log connections.
	tunnel_log("$gateway: $direct connect to $destination:$destport".$authlog);
}
print STDERR "Connecting to $sslproxy:$proxyport$authlog\n" if $debug > 1;
exit(0) if $dry;
# twa<<

# Set up network communication

my ($protocol) = (getprotobyname("tcp"))[2];
my ($proxyip)  = (gethostbyname($sslproxy))[4];
my $localaddr  = pack('S n a4 x8', &AF_INET, 0, "\0\0\0\0");
my $proxyaddr  = pack('S n a4 x8', &AF_INET, $proxyport, $proxyip);

socket (PROXY, &AF_INET, &SOCK_STREAM, $protocol) or
    die("Failed to create socket");
bind (PROXY, $localaddr) or
    die("Failed to bind socket");
connect (PROXY, $proxyaddr) or
    die("Failed to connect to $sslproxy port $proxyport");

# Force flushing of socket buffers

select (PROXY);  $| = 1;
select (STDOUT); $| = 1;

#binmode PROXY;
#binmode STDOUT;
#binmode STDIN;

# twa>>
# Direct connection does not require CONNECT command.
if ( $sslproxy ne $destination ) {
# twa<<
# Send a "CONNECT" command to proxy:
	my $authstring = "";
	$authstring = "Proxy-Authorization: Basic $proxyauth\n" if $proxyauth;
	print STDERR "CONNECT $destination:$destport HTTP/1.0\n$authstring\n";
	print PROXY  "CONNECT $destination:$destport HTTP/1.0\n$authstring\n";

# Wait for HTTP status code, bail out if you don't get back a 2xx code.

	$_ = <PROXY>;
	print STDERR $_;
	my ($status) = (split())[1];

	die("Received a bad status code \"$status\" from proxy server")
		if ( int($status/100) != 2 );

# Skip through remaining part of MIME header

	while(<PROXY>) {
		print STDERR $_;
		chomp;   # Strip <LF>
		last if /^[\r]*$/;		# Empty line or a single <CR> left
	}

# twa>>
}
# twa<<

# Start copying packets in both directions.

# twa&pte>>
# Apparently ssh sends a HUP signal before terminating STDIN session.
# Catch and ignore HUP in order for the main process to exit the while
# loop and continue killing the child process.
$SIG{HUP} = 0;
# twa&pte<<

if(my $child = fork) { # Parent process

    while (sysread(STDIN,$_,4096)) {
        print PROXY;
    }
    kill(15,$child) if $child;
}

else { # Child process
    while (sysread(PROXY,$_,4096)) {
        print STDOUT;
    }
}

sub tunnel_log {
	# Log connections, keep last 20 connection.
	my @lines;
	if ( open(my $fh,$logfile) ) {
		while(<$fh>) { push @lines, $_; }
		close($fh);
	}
	while ($#lines > $logcount-2) { shift @lines; }
	open(my $fh,">$logfile") || return 0;
	while ($lines[0]) { print $fh shift @lines; }
	print $fh join(' ',@_,"\n");
	close($fh);
	return 1;
}

sub getgateway {
	my $routecmd = '/sbin/route -n';
	$routecmd = 'route print' if
		defined ($ENV{TERM}) &&
		$ENV{TERM} =~ m/cygwin/i;
	my $str = '^0.0.0.0';
	$str = '^Default Gateway' if
		$routecmd =~ m/print/;
	my $result = `$routecmd | grep -i \"$str\"`;
	$result =~ s/$str//;
	$result =~ s/^[: \t]*//;
	$result =~ s/[ \t\n\r]*$//;
	my ($gateway) = split(/[ \t]/,$result);
	return $gateway;
}

sub reachable {
	use Net::Ping;
	my $host = $_[0];
	my $port = $_[1];
	my $p = Net::Ping->new('tcp');
	$p->{port_num} = $port;
	print STDERR "Try tcp-ping($host,$port,$timeout)\n" if $debug > 2;
	my $reachable = $p->ping($host,$timeout);
	$p->close();
	return 1 if $reachable;
	return 0 unless $icmp;
	$p = Net::Ping->new('icmp');
	print STDERR "Try icmp-ping($host,$port,$timeout)\n" if $debug > 2;
	$reachable = $p->ping($host,$timeout);
	$p->close();
	return $reachable;
}

#	Expand subnet prefix: 192.168 becomes 192.168.0.0
sub expandPrefix {
	my @list = split(/\./, $_[0].".0.0.0");
	$#list = 3;
	return join('.', @list);
}

#	Check if the given IP Address is part of the given Subnet.
sub isInNet {
	my ($addr,$subnet) = @_;
	my ($prefix,$bits) = split(/\//,$subnet);
	my $mask = netmask($bits);
	my $ipaddr = inet_aton($addr);
	$prefix = expandPrefix($prefix);
	print STDERR "isInNet($addr,$subnet)\n" if $debug > 2;
	print STDERR "isInNet: prefix=$prefix, bits=$bits, ".
		"mask=".inet_ntoa($mask)."\n" if $debug > 3;
	return (inet_ntoa(($ipaddr & $mask)) eq $prefix);
}

#	Check if given IP Address is a Private Internet Address.
sub isPrivateNet {
	my $ipaddr = $_[0];
	my @privAddrs = ( "10/8", "172.16/12", "192.168/16", "169.254/16" );
	foreach ( @privAddrs ) {
		return 1 if isInNet($ipaddr,$_);
	}
	return 0;
}

#	Create netmask for a given number of bits.
#	Example: netmask(11)= 0xFFE00000
sub netmask {
	my $value = 0;
	my $bits = 32 - $_[0];
	while ($bits--) { $value <<= 1; $value |= 1; }
	return inet_aton(~$value);
}

#	======================================================================
#	End Of File: ssh-tunnel.pl

Dans ~/.ssh/config ajouter une section du style:

 Host hal
   HostName www.teuwen.org
   ProxyCommand /usr/local/bin/ssh-tunnel.pl <nom du proxy> <port du proxy> %h %p

ou pour activer la détection automatique, en bas du ficher config:

 Host *
   ProxyCommand /usr/local/bin/ssh-tunnel.pl - - %h %p

avec un fichier ~/.ssh/proxy.conf style

# SSH Tunnel configuration file.

# Section: OPTIONS
[option-section]
debug   = 0
dry     = 0
timeout = 1

# Section: PROXY
[proxy-section]

# Example
1.2.3/24   myproxy:8080

Le script fonctionne aussi bien sous linux que sous cygwin

Utilisation de SSH à travers un proxy requérant une identification

Il faut envoyer en plus la string d'identification au proxy Dans proxy.conf il suffit d'ajouter le login et pwd dans une 3ème et 4ème colonne

Utilisation d'autres services à travers un proxy requérant une identification (vieux!!)

Installez ce script dans par exemple /usr/local/bin/tunnel-auth.pl

#! /usr/bin/perl
#
# tunnel-auth.pl
#
# Usage: tunnel-auth.pl ssl-proxy port destination_host port localport AuthToken
#
# This script can be used for any program to connect to any port via localhost
# It traverses a www-proxy/firewall that supports the http CONNECT
# command described in
# http://home.netscape.com/newsref/std/tunneling_ssl.html
# & http://muffin.doit.org/doc/rfc/tunneling_ssl.html
#
# The AuthToken: cf http://www.zvon.org/tmRFC/RFC2617/Output/chapter2.html
# "To receive authorization, the client sends the userid and password, separated by a
# single colon (":") character, within a base64 encoded string in the credentials"
# Ex:  echo -n "user:password" |base64-encode -> dXNlcjpwYXNzd29yZA==
#
# Example, connect to host named "remote" outside of your firewall:
# $ tunnel-auth.pl www-proxy 80 remote dXNlcjpwYXNzd29yZA=='
# Then use localhost:2222 to connect remote:22!
#
# Comment all PRINT STDOUT if you don't want a dump.
#
# Written by Urban Kaveus <urban@statt.ericsson.se>
# Posted by Urban Kaveus to newsgroup comp.security.ssh on 23 Jan 1997.
# Addition of base64 Authentication by Doegox <phil@teuwen.org>
# Addition of local server for other services than SSH by Doegox <phil@teuwen.org>

#require 'sys/socket.ph';
use Socket;
# Parse command line arguments

if ( $#ARGV != 5 ) {
    print STDERR "Usage: $0 ssl-proxy port destination port localport AuthToken\n";
    exit(1);
}

$sslproxy    = shift;
$proxyport   = shift;
$destination = shift;
$destport    = shift;
$localport   = shift;
$authtoken   = shift;

print STDOUT "\nProxy: $sslproxy:$proxyport\nDest:  $destination:$destport\nLocalPort: $localport\n";

# Makes STDOUT "hot" so always flushed:
select((select(STDOUT), $|=1)[0]);

# Set up network communication

($protocol) = (getprotobyname("tcp"))[2];
($proxyip)  = (gethostbyname($sslproxy))[4];
$localaddr  = pack('S n a4 x8', &AF_INET, 0, "\0\0\0\0");
$proxyaddr  = pack('S n a4 x8', &AF_INET, $proxyport, $proxyip);

# Set up client socket
socket(Server, PF_INET, SOCK_STREAM, $protocol) or
    die("Failed to create socket for client connexion");
setsockopt(Server, SOL_SOCKET, SO_REUSEADDR, pack("l", 1)) || die "setsockopt: $!";
bind(Server, sockaddr_in($localport, INADDR_ANY)) or
    die("Failed to bind socket for client connexion");
listen(Server,SOMAXCONN) or
    die("Failed to listen for client connexion");
my $paddr;
$SIG{CHLD} = \&REAPER;
$paddr = accept(Client,Server);
my($localport,$iaddr) = sockaddr_in($paddr);
my $name = gethostbyaddr($iaddr,AF_INET);
# Force flushing of socket buffers
select (Client); $| = 1;
print STDOUT "Client connected to $name\n";

# Set up proxy connexion
socket (PROXY, &AF_INET, &SOCK_STREAM, $protocol) or
    die("Failed to create socket for proxy connexion");
bind (PROXY, $localaddr) or
    die("Failed to bind socket for proxy connexion");
connect (PROXY, $proxyaddr) or
    die("Failed to connect to $sslproxy port $proxyport");

# Force flushing of socket buffers
select (PROXY);  $| = 1;

# Send a "CONNECT" command to proxy:

print PROXY "CONNECT $destination:$destport HTTP/1.0\r\nProxy-Authorization: Basic  $authtoken\r\n\r\n";

# Wait for HTTP status code, bail out if you don't get back a 2xx code.

$_ = <PROXY>;
print STDOUT "Server connected to $destination:$destport\n";
print STDOUT "Reply of server:$_";

($status) = (split())[1];

die("Received a bad status code \"$status\" from proxy server")
    if ( int($status/100) != 2 );

# Skip through remaining part of MIME header

while(<PROXY>) {
    chomp;   # Strip <LF>
    last if /^[\r]*$/;		# Empty line or a single <CR> left
}

# Start copying packets in both directions.

if($child = fork) { # Parent process
    while (sysread(PROXY,$_,4096)) {
		print STDOUT "\n\n#<-#$_";
        print Client;
    }
    sleep 2;
    kill(15,$child) if $child;
}

else { # Child process
    while (sysread(Client,$_,4096)) {
    	print STDOUT "\n\n#->#$_";
		print PROXY;
    }
}

Pour l'utiliser par exemple pour Jabber:

/usr/local/bin/tunnel-auth.pl <nom du proxy> <port du proxy> 212.68.212.217 <string d'identification>

Le client peut alors se connecter sur 127.0.0.1:5222
Par défaut, un dump de la communication apparaîtra dans la console.
Si cela est dérangeant, par exemple si la communication se fait en SSL, rediriger la sortie.

/usr/local/bin/tunnel-auth.pl <nom du proxy> <port du proxy> 212.68.212.217 <string d'identification> >/dev/null

L'adresse de destination doit sans doutes être chiffrée (IP) plutôt que textuelle (Nom de domaine)
Si cela est gênant par ex pour le cas d'un serveur jabber, ajouter la correspondance dans /etc/hosts (ou C:\WINNT\system32\drivers\etc\hosts):

127.0.0.1 jabber.reseaucitoyen.be

et utiliser le nom de domaine réel dans le client plutôt que 127.0.0.1

Autre solution pour utiliser d'autres services que SSH:
On peut bien entendu se contenter des premiers scripts pour SSH et utiliser SSH pour créer un tunnel vers une machine à l'extérieur:

ssh -L5222:jabber.reseaucitoyen.be:5222 -N user@hal

Où hal a été configuré dans le ~/.ssh/config, cf plus haut

Robustesse

Il se peut que la communication soit cassée par le proxy de temps à autres
Pour la rendre robuste, on peut utiliser par exemple la commande suivante:

sh -c "while true; do date; ssh <host>; sleep 30; done"

Conjointement à l'utilisation de l'option "ServerAliveInterval 10" dans config cela garantit de redémarrer le tunnel endéans la minute (ServerAliveInterval*ServerAliveCountMax(=3)+sleep).
Enfin pour générer du traffic ce qui tend à garder la connexion ouverte par le proxy: pour une communication ssh avec terminal, voir le paquet spinner et pour une communication ssh uniquement avec déport de port et sans shell on peut créer qqch comme:

#!/bin/bash

ANSI_XY_SAVE="\033[s"
ANSI_XY_RESTORE="\033[u"
STAR='-\|/'
echo -n "Dummy login "
for ((k=0;k<5;k=(k+1)%4));do
    echo -e -n "${ANSI_XY_SAVE}${STAR:$k:1} ${ANSI_XY_RESTORE}"
    sleep 5
done

à sauver dans /usr/local/bin/star.sh et l'activer:

chsh -s /usr/local/bin/star.sh <user>

Next step: Through real SSL Proxies

Nowadays the proxies are a bit smarter and don't let you CONNECT to ports, even port 443, if you're not talking SSL.
So for those proxies you have to talk

• only on port 443, other ports fail
• or SSL only, SSH or other protocols fail
• or both: only SSL only on port 443

Talking SSL but not on the right port

Example: jabber server on port 5223, XML over SSL
That's easy providing that you can use port 443 on another server.
You can simply bounce the packets between the clients and the jabber server with some iptables on your server with a free port 443:

IPTABLES -t nat -A PREROUTING -i eth0 -d my.free.ip -p tcp --dport 443 -j DNAT --to-destination jabber.server.ip:5223
IPTABLES -A FORWARD -d jabber.server.ip -p tcp --dport 5223 -j ACCEPT
IPTABLES -A FORWARD -s jabber.server.ip -p tcp --sport 5223 -j ACCEPT
IPTABLES -t nat -A POSTROUTING -o eth0 -d jabber.server.ip -p tcp --dport 5223 -j SNAT --to-source my.free.ip

So now the connection appears to be really SSL on the port 443.

Example is my jabber bouncer: jabber-rc.yobi.be port 443 => jabber.reseaucitoyen.be port 5223
You can try with e.g. Psi which is capable of connecting through a proxy and to another server/port than the real one.

Not talking SSL

You can use SSL wrappers to encapsulate the traffic in sth that looks like a real SSL connection (and it is).
Look at stunnel, stunnel4 or crywrap

Now you don't have tons of IPs and you want already to run your Apache on port 443, so what?

Here is an interesting script which serves as HTTPS server, GET and POST are served by reverse proxy, the script contacts the local Apache, and CONNECT can be used to connect to e.g. the SSH server you desesperately wanted to reach.

Client -> BigBrotherProxy -> 443:Script -> Apache or SSH!

And if an admin wants to check that IP you're connecting to in SSL, he will get... an SSL Apache ;-)
Of course your client has to be smart enough to be able to do a CONNECT / SSL / CONNECT string before letting e.g. SSH talking to its server.

Ok ok but why not using directly Apache with sth like that?

<VirtualHost 85.234.207.99:443>
  ...
  SSLEngine on
  ...
  ProxyRequests on 
  AllowCONNECT 22
  <Proxy *>  
     Some ACLs, we don't want to be universal proxy!
  </Proxy> 
</VirtualHost>

That would be wonderful but it appears that Apache, as soon as you do a CONNECT, becomes crystal and everything goes through it untouched, so the SSH server gets SSL-encrypted jam and its reply goes untouched to you while you were expecting SSL!
Slight difference between Apache 1.3 and Apache 2 is that the first one sends you its "HTTP/1.0 200 Connection established" still in SSL while the second already drops SSL before sending the msg in clear.
But anyway it's simply unusable in this stage.

Visibly other people were looking to the same direction and this bugreport, actually a feature request with a patch, seems to bring exactly what we want!

The patch applied smoothly to the current Debian Etch version (2.2.3-3.2)

apt-get build-dep apache2
apt-get install fakeroot
apt-get source apache2
apply the patch...
dpkg-buildpackage -uc -us -rfakeroot
coffee...

And now the fresh apache2.2-common_2.2.3-3.2_amd64.deb contains our patched /usr/lib/apache2/modules/mod_proxy_connect.so

To avoid problems at further upgrades, I move the new module to a new name:

mod_proxy_connect.so -> /usr/lib/apache2/modules/mod_proxy_connect_ssl.so

And create the corresponding config files:

/etc/apache2/mods-available/proxy_connect_ssl.load:
LoadModule proxy_connect_module /usr/lib/apache2/modules/mod_proxy_connect_ssl.so 

And /etc/apache2/mods-enabled/proxy_connect_ssl.load pointing to the previous one as usual.

First test:

socat - OPENSSL:my.server:443,verify=0
CONNECT another.server:22 HTTP/1.0

HTTP/1.0 200 Connection Established
Proxy-agent: blabla

SSH-2.0-OpenSSH_4.3p2 Debian-8

hehe :-)

I don't think socat can cumulate proxy and ssl, but we can cascade stuffs:

socat TCP4-LISTEN:1234 OPENSSL:my.server:443,verify=0 &
socat TCP4-LISTEN:4321 PROXY:127.0.0.1:another.server:22,proxyport=1234 &
ssh -p 4321 127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
RSA key fingerprint is ff:cb:6d:f1:b8:a8:96:fe:08:1b:53:0f:dc:0f:6c:73.
Are you sure you want to continue connecting (yes/no)?
YESSS :-)

Next step: proxy authentication

<VirtualHost *:443>
  ...
  SSLEngine on
  ...
  ProxyRequests on
  AllowCONNECT 22
  <Proxy *>
     Order deny,allow
     Allow from all
     AuthType Basic
     AuthName "Password Required"
     AuthUserFile /path/to/htpasswd
     Require valid-user
  </Proxy> 
</VirtualHost>

By default AllowCONNECT only accepts 443 and 563 so you probably want to extend it to 22 and the other services you want to reach (VPN?)

Example:

socat TCP4-LISTEN:1234 OPENSSL:my.server:443,verify=0 &
socat TCP4-LISTEN:4321 PROXY:127.0.0.1:another.server:22,proxyport=1234,proxyauth=user:pass &
ssh -p 4321 127.0.0.1

And as the goal is to go through an enterprise proxy, it becomes sth similar to:

socat TCP4-LISTEN:5555 PROXY:big.brother.proxy:my.server:443,proxyport=8080 &
socat TCP4-LISTEN:1234 OPENSSL:127.0.0.1:5555,verify=0 &
socat TCP4-LISTEN:4321 PROXY:127.0.0.1:another.server:22,proxyport=1234,proxyauth=user:pass &
ssh -p 4321 127.0.0.1

That's just for a 3 lines test, but now we know we can extend our initial script described at the beginning of this page.