Sunday, 11 March 2018

Proxy and Direct Connection vs SSL/TSL Connection

Does have the Proxy  privileges? Yes, if you're running out of quota, and bandwidth starts to narrow. Don't you believe?

Now I will prove it with some tools from Back | Track 5 and Windows. Among them are Etherape, Network Proxy Manager, and Proxy Switcher.

In the previous post, I've explained about how to find a Proxy that matches your network using Proxy Switcher. After getting the proxy, you can start trying the difference between Proxy and Direct Connection.

Straight to


Open Network Proxy Manager by selecting System -> Preferences -> Network Proxy

Select Dirrect Internet Connection. In this option, you are using a direct connection to a website. Or do not use Proxy. Do not forget to install your Etherape with the following command: apt-get install update, then apt-get install etherape. After etherape is installed, open etherape with navigation Applications -> Internet -> Etherape.
If you are using a dial-up modem, then Select Capture-> Interface -> ppp0 — Then Etherape will start scanning any connections that occur on the ppp0 interface.

I'm opening facebook, and seen modem start contacting some sites to load web pages. Usually the sites in this contact, is an advertising site.

Then what to do with slowing down the modem performance? It is obvious that the modem is getting distracted by contacting many websti just for loading one page, not to mention if you open multiple websites at a time. This is what makes your internet connection slow.

So what if we use a modem?

It appears that I only contact two IP addresses, even though I open 4 sites at once. This is what makes your modem work faster, because he only calls 2 IP addresses.

So what do two IP addresses do? Of course download the data, and give it to you. This means that he is connecting like picture one (without proxy). Interested?


Direct SSL/TLS connection

When a browser creates a direct secure connection with an origin server, there are no HTTP CONNECT requests.

The first HTTP request sent on such a connection is already encrypted. In most cases, Squid is out of the loop: Squid knows nothing about that connection and cannot block or proxy that traffic. The reverse proxy and interception exceptions are described below.

Direct SSL/TLS connection to a reverse proxy

Squid-2.5 and later can terminate TLS or SSL connections. You must have built with --enable-ssl. See https_port for more information. Squid-3.5 and later autodetect the availability of GnuTLS library and enable the functionality if available. OpenSSL or LibreSSL must be enabled explicitly with the --with-openssl configure option. If the library is installed in a non-standard location you may need to use the --with-foo=PATH configure option. See configure --help for details.

This is perhaps most useful in a surrogate (aka, http accelerator, reverse proxy) configuration. Simply configure Squid with a normal reverse proxy configuration using port 443 and SSL certificate details on an https_port line.

Bumping direct SSL/TLS connections

{X} WARNING: {X} HTTPS was designed to give users an expectation of privacy and security. Decrypting HTTPS tunnels without user consent or knowledge may violate ethical norms and may be illegal in your jurisdiction. Squid decryption features described here and elsewhere are designed for deployment with user consent or, at the very least, in environments where decryption without consent is legal.

These features also illustrate why users should be careful with trusting HTTPS connections and why the weakest link in the chain of HTTPS protections is rather fragile. Decrypting HTTPS tunnels constitutes a man-in-the-middle attack from the overall network security point of view. Attack tools are an equivalent of an atomic bomb in real world: Make sure you understand what you are doing and that your decision makers have enough information to make wise choices.

A combination of Squid NAT Interception, SslBump, and associated features can be used to intercept direct HTTPS connections and decrypt HTTPS messages while they pass through a Squid proxy.

This allows dealing with HTTPS messages sent to the origin server as if they were regular HTTP messages, including applying detailed access controls and performing content adaptation (e.g., check request bodies for information leaks and check responses for viruses). Configuration mistakes, Squid bugs, and malicious attacks may lead to unencrypted messages escaping Squid boundaries.

Currently, Squid-to-client traffic on intercepted direct HTTPS connections cannot use Dynamic Certificate Generation, leading to browser warnings and rendering such configurations nearly impractical. This limitation will be addressed by the bump-server-first project.

From the browser point of view, intercepted messages are not sent to a proxy. Thus, general interception limitations, such as inability to authenticate requests, apply to bumped intercepted transactions as well.

Encrypted browser-Squid connection

While HTTPS design efforts were focused on end-to-end communication, it would also be nice to be able to encrypt the browser-to-proxy connection (without creating a CONNECT tunnel that blocks Squid from accessing and caching content). This would allow, for example, a secure use of remote proxies located across a possibly hostile network.

Squid can accept regular proxy traffic using https_port in the same way Squid does it using an http_port directive. Unfortunately, popular modern browsers do not permit configuration of TLS/SSL encrypted proxy connections. There are open bug reports against most of those browsers now, waiting for support to appear. If you have any interest, please assist browser teams with getting that to happen.

Mean while, tricks using stunnel or SSH Tunnels are required to encrypt the browser-to-proxy connection before it leaves the client machine. These are somewhat heavy on the network and can be slow as a result.

Chrome

The Chrome browser is able to connect to proxies over SSL connections if configured to use one in a PAC file or command line switch. GUI configuration appears not to be possible (yet).

More details at http://dev.chromium.org/developers/design-documents/secure-web-proxy

Firefox

The Firefox 33.0 browser is able to connect to proxies over TLS connections if configured to use one in a PAC file. GUI configuration appears not to be possible (yet), though there is a config hack for embedding PAC logic.

There is still an important bug open: Using a client certificate authentication to a proxy: https://bugzilla.mozilla.org/show_bug.cgi?id=209312

If you have trouble with adding trust for the proxy cert, there is a process by Patrick McManus to workaround that.

I hove that usefull and thanks for visit my simple blog :D :')


EmoticonEmoticon