1

I need to filter (send to BANRULES set) incoming http/https packets with a certain string (matchword). I do it easy when ssl is not in use (port 80):

iptables -A INPUT -p tcp -m tcp --dport 80 -m string --string "matchword" --algo bm --to 65535 -j BANRULES

But it does not work (because of packet encryption) when ssl is in use (port 443):

iptables -A INPUT -p tcp -m tcp --dport 443 -m string --string "matchword" --algo bm --to 65535 -j BANRULES

How can I do this? Thank You very Much.

0

1 Answer 1

0

If the SSL is encrypted end-to-end with keys you don't have access to, and one of the ends isn't the box you're trying to filter from, there is no (efficient) way to do this with SSL. That's the point of encryption.

You could attempt to execute a man in the middle attack against one of the ends of the connection, but:

  • That may or may not be illegal, depending on the circumstances;
  • The client may possibly become aware of the MITM if the HTTPS session uses HSTS and OCSP stapling;
  • Without direct control (administrative/root access) to the client or the server, it would be very difficult to execute the man in the middle attack successfully.

How do you filter SSL? Well, you have a few options:

  • Obtain legitimate administrative/root access to the client, server, or both, and configure them to accept a certificate that you have the private key for on your router box;
  • Do something illegal and/or morally reprehensible like MITM unsuspecting users;
  • Prove that P = NP and then develop an efficient algorithm for factoring integers;
  • Throw an enormous datacenter at brute forcing each encrypted block (I feel sorry for your users' latency, though, even in the best case);
  • Attempt to analyze the "shape" of the traffic (traffic shape analysis -- Google it) to determine if it's something you might potentially want to block; or -- my preferred solution:
  • Don't.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .