Cannot intercept protocol in which SSL connection is initiated by the server #334
Description
I am trying to intercept a custom, SSL-encrypted protocol where the client (192.168.150.201) establishes an initial TCP connection from port 9999 to the server (192.168.150.150) at port 541, and then the server send a "Client Hello" in return. The issue is, as the title says, the SSL traffic is not getting intercepted by the server. The protocol looks "switched" to me in the sense that the server sends the "Client Hello" here. Can that be the reason sslsplit is failing to work?
sslsplit is running on a Ubuntu 22.04 Server (5.15.0-101-generic x86-64) with a host IP of 192.168.150.1. The server and client are running on two VMs with the IPs listed above. The physical server, the server, and the client are a part of KVM NAT network (192.168.150.0/24). The physical server, which sslsplit is running on, acts like a router.
The traffic redirection is done via iptables:
iptables -t nat -A PREROUTING -p tcp --dport 541 -j REDIRECT --to-ports 10541
sslsplit is running as follows:
sslsplit -D -l connections.log -j . -M ssl_key_logfile -S log -k server.key -c server.crt -b client.key -a client.crt ssl 192.168.150.1 10541
Communication between the client and the server:
To rule out any error on my part, I have tested my sslsplit setup on a simple SSL server-client app. It works as expected, i.e., I am able to intercept and view SSL-encrypted traffic.