|
152 | 152 | <li><a href="#NAMES">How to resolve names through a parent proxy</a></li> |
153 | 153 | <li><a href="#ISFTP">How to set up an FTP proxy</a></li> |
154 | 154 | <li><a href="#TLSPR">How to set up an SNI proxy (tlspr)</a></li> |
155 | | - <li><a href="#SSLPLUGIN">How to set up TLS/SSL with SSLPlugin (https proxy, mTLS)</a></li> |
156 | | - <li><a href="#CERTIFICATES">How to create CA and certificates for SSLPlugin</a></li> |
| 155 | + <li><a href="#SSLPLUGIN">How to set up TLS/SSL (https proxy, mTLS)</a></li> |
| 156 | + <li><a href="#CERTIFICATES">How to create CA and certificates for SSL</a></li> |
| 157 | + <li><a href="#PCRE">How to use PCRE filtering (regular expressions)</a></li> |
157 | 158 | <li><A HREF="#AUTH">How to limit service access</A> |
158 | 159 | <li><A HREF="#USERS">How to create a user list</A> |
159 | 160 | <li><A HREF="#ACL">How to limit user access to resources</A> |
|
758 | 759 | proxy |
759 | 760 | </pre> |
760 | 761 | </p> |
761 | | - <li><a name="SSLPLUGIN"><i>How to set up TLS/SSL with SSLPlugin (https proxy, mTLS)</i></a> |
| 762 | + <li><a name="SSLPLUGIN"><i>How to set up TLS/SSL (https proxy, mTLS)</i></a> |
762 | 763 | <p> |
763 | | -SSLPlugin provides TLS/SSL support for 3proxy. It can be used to: |
| 764 | +Since version 0.9.7, SSL/TLS support is built into 3proxy when compiled with OpenSSL |
| 765 | +(WITH_SSL). Previously available as SSLPlugin, the functionality is now integrated |
| 766 | +into the main binary. The plugin line is no longer required. |
| 767 | +SSL/TLS support can be used to: |
764 | 768 | <ul> |
765 | 769 | <li>Create an https:// proxy (TLS-encrypted connection between client and proxy)</li> |
766 | 770 | <li>Implement MITM for TLS traffic inspection</li> |
|
773 | 777 | <br>To create an https:// proxy, you need a server certificate and key. The certificate must not be self-signed |
774 | 778 | and should contain Subject Alternative Names (SAN) for the proxy hostname/IP. |
775 | 779 | </p><pre> |
776 | | -plugin /path/to/SSLPlugin.ld.so ssl_plugin |
777 | 780 | ssl_server_cert /etc/3proxy/certs/server.crt |
778 | 781 | ssl_server_key /etc/3proxy/certs/server.key |
779 | 782 | ssl_serv |
|
789 | 792 | <b>Client certificate authentication (mTLS):</b> |
790 | 793 | <br>To require clients to authenticate with a certificate, use ssl_server_verify and provide the CA certificate: |
791 | 794 | </p><pre> |
792 | | -plugin /path/to/SSLPlugin.ld.so ssl_plugin |
793 | 795 | ssl_server_cert /etc/3proxy/certs/server.crt |
794 | 796 | ssl_server_key /etc/3proxy/certs/server.key |
795 | 797 | ssl_server_ca_file /etc/3proxy/certs/ca.crt |
|
804 | 806 | <b>MITM for TLS traffic inspection:</b> |
805 | 807 | <br>To intercept and decrypt TLS traffic, you need a CA certificate to generate spoofed server certificates: |
806 | 808 | </p><pre> |
807 | | -plugin /path/to/SSLPlugin.ld.so ssl_plugin |
808 | 809 | ssl_server_ca_file /etc/3proxy/certs/ca.crt |
809 | 810 | ssl_server_ca_key /etc/3proxy/certs/ca.key |
810 | 811 | ssl_client_verify |
|
822 | 823 | <b>TLS client (connect to upstream via TLS):</b> |
823 | 824 | <br>To connect to upstream servers via TLS with client certificate authentication: |
824 | 825 | </p><pre> |
825 | | -plugin /path/to/SSLPlugin.ld.so ssl_plugin |
826 | 826 | ssl_client_cert /etc/3proxy/certs/client.crt |
827 | 827 | ssl_client_key /etc/3proxy/certs/client.key |
828 | 828 | ssl_client_verify |
|
834 | 834 | <b>Conditional TLS for parent proxy (ssl_client_mode 3):</b> |
835 | 835 | <br>With ssl_client_mode 3, TLS handshake to parent proxy is performed only if the parent type ends with 's' (secure types). This allows mixing secure and non-secure parent proxies in the same configuration: |
836 | 836 | </p><pre> |
837 | | -plugin /path/to/SSLPlugin.ld.so ssl_plugin |
838 | 837 | ssl_server_cert /etc/3proxy/certs/server.crt |
839 | 838 | ssl_server_key /etc/3proxy/certs/server.key |
840 | 839 | ssl_client_mode 3 |
|
853 | 852 | <p> |
854 | 853 | This creates an HTTPS proxy (ssl_serv) that accepts TLS connections from clients. For parent proxy connections, user1's traffic goes through an https parent with TLS encryption (secure type), while user2's traffic goes through a regular socks5 parent without TLS. Secure parent types include: tcps, https, connects, connect+s, socks4s, socks5s, socks4+s, socks5+s, pop3s, smtps, ftps. |
855 | 854 | </p> |
856 | | - <li><a name="CERTIFICATES"><i>How to create CA and certificates for SSLPlugin</i></a> |
| 855 | + <li><a name="CERTIFICATES"><i>How to create CA and certificates for SSL</i></a> |
857 | 856 | <p> |
858 | 857 | <b>Creating a Certificate Authority (CA):</b> |
859 | 858 | <br>For MITM or mTLS, you need a CA. Generate a CA private key and certificate: |
|
968 | 967 | openssl pkcs12 -export -out client.p12 -passout pass: \ |
969 | 968 | -inkey client.key -in client.crt -certfile ca.crt |
970 | 969 | </pre> |
| 970 | + <li><a name="PCRE"><i>How to use PCRE filtering (regular expressions)</i></a> |
| 971 | +<p> |
| 972 | +Since version 0.9.7, PCRE (Perl Compatible Regular Expressions) filtering is built into |
| 973 | +3proxy when compiled with PCRE2 support (WITH_PCRE). Previously available as PCREPlugin, |
| 974 | +the functionality is now integrated into the main binary. The plugin line is no longer required. |
| 975 | +</p> |
| 976 | +<p> |
| 977 | +PCRE filtering can be used to create matching and replacement rules with regular expressions |
| 978 | +for client requests, client and server headers, and client and server data. |
| 979 | +</p> |
| 980 | +<p> |
| 981 | +<b>Commands:</b> |
| 982 | +</p><pre> |
| 983 | +pcre TYPE FILTER_ACTION REGEXP [ACE] |
| 984 | +pcre_rewrite TYPE FILTER_ACTION REGEXP REWRITE_EXPRESSION [ACE] |
| 985 | +pcre_extend FILTER_ACTION [ACE] |
| 986 | +pcre_options OPTION1 [...] |
| 987 | +</pre> |
| 988 | +<p> |
| 989 | +<ul> |
| 990 | +<li><b>TYPE</b> - type of filtered data (comma-delimited list): |
| 991 | + <ul> |
| 992 | + <li><b>request</b> - content of the client's request (e.g., HTTP GET request string) |
| 993 | + <li><b>cliheader</b> - content of the client request headers |
| 994 | + <li><b>srvheader</b> - content of the server's reply headers |
| 995 | + <li><b>clidata</b> - data received from the client (e.g., HTTP POST data) |
| 996 | + <li><b>srvdata</b> - data received from the server (e.g., HTML page) |
| 997 | + </ul> |
| 998 | +<li><b>FILTER_ACTION</b> - action on match: |
| 999 | + <ul> |
| 1000 | + <li><b>allow</b> - allow this request without checking the rest of the rules |
| 1001 | + <li><b>deny</b> - deny this request without checking the rest of the rules |
| 1002 | + <li><b>dunno</b> - continue with the rest of the rules (useful with pcre_rewrite) |
| 1003 | + </ul> |
| 1004 | +<li><b>REGEXP</b> - PCRE (Perl) regular expression. Use * if no regexp matching is required. |
| 1005 | +<li><b>REWRITE_EXPRESSION</b> - substitution string. May contain Perl-style substrings |
| 1006 | +$1, $2, etc. $0 means the whole matched string. \r and \n may be used to insert new lines. |
| 1007 | +<li><b>ACE</b> - access control entry (user names, source IPs, destination IPs, ports, etc.), |
| 1008 | +identical to allow/deny/bandlimin commands. The regular expression is only matched if the ACL |
| 1009 | +matches the connection data. |
| 1010 | +</ul> |
| 1011 | +</p> |
| 1012 | +<p> |
| 1013 | +<b>Examples:</b> |
| 1014 | +</p><pre> |
| 1015 | +# Block requests containing specific keywords for certain users |
| 1016 | +pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16 |
| 1017 | + |
| 1018 | +# Block responses with specific content type |
| 1019 | +pcre srvheader deny "Content-type: application" |
| 1020 | + |
| 1021 | +# Replace content in both directions (censorship) |
| 1022 | +pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser |
| 1023 | +pcre_extend deny * 192.168.0.1/16 |
| 1024 | +</pre> |
| 1025 | +<p> |
| 1026 | +<b>Note:</b> Regular expressions don't require authentication and cannot replace |
| 1027 | +authentication and/or allow/deny ACLs. |
| 1028 | +</p> |
971 | 1029 | <li><A NAME="AUTH">How to limit service access</A> |
972 | 1030 | <p> |
973 | 1031 | First, always specify the internal interface to accept incoming connections with the |
|
0 commit comments