From 925209ef4f474a85e7ff68087f5fec7881785473 Mon Sep 17 00:00:00 2001 From: Alexander Neumann Date: Fri, 20 Feb 2015 07:47:35 +0100 Subject: [PATCH 1/3] Add hints for using Linux iptables REDIRECT target --- sslsplit.1 | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sslsplit.1 b/sslsplit.1 index e888b4d..fbdecbe 100644 --- a/sslsplit.1 +++ b/sslsplit.1 @@ -487,7 +487,9 @@ Assuming inbound interface \fBbge0\fP: .B netfilter Linux netfilter using the iptables REDIRECT target. Only supports IPv4 due to limitations in the SO_ORIGINAL_DST getsockopt(2) -interface. +interface. Please note that SSLsplit is only able to accept incoming +connections if it binds to the correct IP address (e.g. 192.0.2.1) or on all +interfaces (0.0.0.0). .LP .RS .nf @@ -552,6 +554,11 @@ available on your system): .fi .RE .LP +If the Linux netfilter engine is used with the iptables REDIRECT target, it is +important to listen to the correct IP address (e.g. 192.0.2.1) or on the +wildcard (0.0.0.0), otherwise SSLsplit is not able to accept incoming +connections. +.LP Intercepting IMAP/IMAPS using the same settings: .LP .HS From 6a78aeed2d06d4d895a54cc864a42cce5e00a6f8 Mon Sep 17 00:00:00 2001 From: Daniel Roethlisberger Date: Tue, 24 Feb 2015 20:52:12 +0100 Subject: [PATCH 2/3] Minor rewording --- sslsplit.1 | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/sslsplit.1 b/sslsplit.1 index 91fba93..0e917ba 100644 --- a/sslsplit.1 +++ b/sslsplit.1 @@ -508,9 +508,7 @@ Assuming inbound interface \fBbge0\fP: .B netfilter Linux netfilter using the iptables REDIRECT target. Only supports IPv4 due to limitations in the SO_ORIGINAL_DST getsockopt(2) -interface. Please note that SSLsplit is only able to accept incoming -connections if it binds to the correct IP address (e.g. 192.0.2.1) or on all -interfaces (0.0.0.0). +interface. .LP .RS .nf @@ -521,6 +519,11 @@ interfaces (0.0.0.0). -p tcp --dport 443 \\ -j REDIRECT --to-ports 10443\fP .fi +.LP +Note that SSLsplit is only able to accept incoming connections if it binds +to the correct IP address (e.g. 192.0.2.1) or on all interfaces (0.0.0.0). +REDIRECT uses the local interface address of the incoming interface as +target IP address, or 127.0.0.1 for locally generated packets. .RE .TP .B tproxy @@ -576,8 +579,8 @@ available on your system): .RE .LP If the Linux netfilter engine is used with the iptables REDIRECT target, it is -important to listen to the correct IP address (e.g. 192.0.2.1) or on the -wildcard (0.0.0.0), otherwise SSLsplit is not able to accept incoming +important to listen to the correct IP address (e.g. 192.0.2.1) or on all +interfaces (0.0.0.0), otherwise SSLsplit is not able to accept incoming connections. .LP Intercepting IMAP/IMAPS using the same settings: From 62cd0b8af6787cbdfe128aeaef54df62a3f97b21 Mon Sep 17 00:00:00 2001 From: Daniel Roethlisberger Date: Tue, 24 Feb 2015 20:56:27 +0100 Subject: [PATCH 3/3] Update list of contributors --- AUTHORS.md | 5 +++-- sslsplit.1 | 6 +++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/AUTHORS.md b/AUTHORS.md index d0185ee..241bef9 100644 --- a/AUTHORS.md +++ b/AUTHORS.md @@ -6,10 +6,11 @@ SSLsplit was written and is being maintained by The following individuals have contributed to the codebase by submitting patches or pull requests, in chronological order of their first contribution: -- Steve Wills ([swills](https://github.com/swills)) +- Steve Wills ([swills](https://github.com/swills)) - Landon Fuller ([landonf](https://github.com/landonf)) -- Wayne Jensen ([wjjensen](https://github.com/wjjensen)) +- Wayne Jensen ([wjjensen](https://github.com/wjjensen)) - Rory McNamara ([psychomario](https://github.com/psychomario)) +- Alexander Neumann ([fd0](https://github.com/fd0)) Many more individuals have contributed by reporting bugs or feature requests. See [issue tracker on Github][1], `NEWS.md` and `git log` for details. diff --git a/sslsplit.1 b/sslsplit.1 index 0e917ba..7e34476 100644 --- a/sslsplit.1 +++ b/sslsplit.1 @@ -681,9 +681,9 @@ hostapd(8), arpspoof(8), parasite6(8), yersinia(8), .SH AUTHORS SSLsplit was written by Daniel Roethlisberger . -The following individuals have contributed to the codebase, in chronological -order of their first contribution: -Steve Wills, Landon Fuller, Wayne Jensen and Rory McNamara. +The following individuals have contributed code or documentation, in +chronological order of their first contribution: +Steve Wills, Landon Fuller, Wayne Jensen, Rory McNamara and Alexander Neumann. .SH BUGS Use Github for submission of bug reports or patches: .LP