{"action":"created","issue":{"url":"https://api.github.com/repos/droe/sslsplit/issues/92","labels_url":"https://api.github.com/repos/droe/sslsplit/issues/92/labels{/name}","comments_url":"https://api.github.com/repos/droe/sslsplit/issues/92/comments","events_url":"https://api.github.com/repos/droe/sslsplit/issues/92/events","html_url":"https://github.com/droe/sslsplit/issues/92","id":70900383,"number":92,"title":"'Error creating SSL' for SSL Passthrough with -t and empty directory","user":{"login":"xelalexv","id":4679428,"avatar_url":"https://avatars.githubusercontent.com/u/4679428?v=3","gravatar_id":"","url":"https://api.github.com/users/xelalexv","html_url":"https://github.com/xelalexv","followers_url":"https://api.github.com/users/xelalexv/followers","following_url":"https://api.github.com/users/xelalexv/following{/other_user}","gists_url":"https://api.github.com/users/xelalexv/gists{/gist_id}","starred_url":"https://api.github.com/users/xelalexv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xelalexv/subscriptions","organizations_url":"https://api.github.com/users/xelalexv/orgs","repos_url":"https://api.github.com/users/xelalexv/repos","events_url":"https://api.github.com/users/xelalexv/events{/privacy}","received_events_url":"https://api.github.com/users/xelalexv/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/droe/sslsplit/labels/bug","name":"bug","color":"207de5"},{"url":"https://api.github.com/repos/droe/sslsplit/labels/merged-to-develop","name":"merged-to-develop","color":"009800"}],"state":"closed","locked":false,"assignee":{"login":"droe","id":749226,"avatar_url":"https://avatars.githubusercontent.com/u/749226?v=3","gravatar_id":"","url":"https://api.github.com/users/droe","html_url":"https://github.com/droe","followers_url":"https://api.github.com/users/droe/followers","following_url":"https://api.github.com/users/droe/following{/other_user}","gists_url":"https://api.github.com/users/droe/gists{/gist_id}","starred_url":"https://api.github.com/users/droe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/droe/subscriptions","organizations_url":"https://api.github.com/users/droe/orgs","repos_url":"https://api.github.com/users/droe/repos","events_url":"https://api.github.com/users/droe/events{/privacy}","received_events_url":"https://api.github.com/users/droe/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/droe/sslsplit/milestones/3","html_url":"https://github.com/droe/sslsplit/milestones/0.5.0","labels_url":"https://api.github.com/repos/droe/sslsplit/milestones/3/labels","id":537318,"number":3,"title":"0.5.0","description":"","creator":{"login":"droe","id":749226,"avatar_url":"https://avatars.githubusercontent.com/u/749226?v=3","gravatar_id":"","url":"https://api.github.com/users/droe","html_url":"https://github.com/droe","followers_url":"https://api.github.com/users/droe/followers","following_url":"https://api.github.com/users/droe/following{/other_user}","gists_url":"https://api.github.com/users/droe/gists{/gist_id}","starred_url":"https://api.github.com/users/droe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/droe/subscriptions","organizations_url":"https://api.github.com/users/droe/orgs","repos_url":"https://api.github.com/users/droe/repos","events_url":"https://api.github.com/users/droe/events{/privacy}","received_events_url":"https://api.github.com/users/droe/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":17,"state":"open","created_at":"2014-01-15T18:38:18Z","updated_at":"2015-04-30T15:01:38Z","due_on":"2015-04-25T22:00:00Z","closed_at":null},"comments":4,"created_at":"2015-04-25T12:05:33Z","updated_at":"2015-04-30T15:01:38Z","closed_at":"2015-04-30T15:01:38Z","body":"I'm trying to set up sslsplit as a transparent proxy for HTTP and HTTPS (passthrough only). Setup has two machines, client and proxy. Proxy is set as default gateway on client. On proxy, I enabled IP forwarding and added to iptables: \r\n\r\n```bash\r\nsudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080\r\nsudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443\r\n```\r\n\r\nI'm starting sslsplit like this:\r\n\r\n```bash\r\n./sslsplit -D -t ./certdir/ -P https 0.0.0.0 8443 http 0.0.0.0 8080\r\n```\r\n```certdir``` is empty so that all HTTPS is passed through. Works so far for HTTP, but no joy with HTTPS. When requesting https://www.google.de with FF on client:\r\n\r\n```log\r\nSSLsplit 0.4.11 (built 2015-04-25)\r\nCopyright (c) 2009-2014, Daniel Roethlisberger <daniel@roe.ch>\r\nhttp://www.roe.ch/SSLsplit\r\nBuild info: V:GIT\r\nFeatures: -DHAVE_NETFILTER\r\nNAT engines: netfilter* tproxy\r\nnetfilter: IP_TRANSPARENT SOL_IPV6 !IPV6_ORIGINAL_DST\r\nLocal process info support: no\r\ncompiled against OpenSSL 1.0.1f 6 Jan 2014 (1000106f)\r\nrtlinked against OpenSSL 1.0.1f 6 Jan 2014 (1000106f)\r\nTLS Server Name Indication (SNI) supported\r\nOpenSSL is thread-safe with THREADID\r\nUsing SSL_MODE_RELEASE_BUFFERS\r\nSSL/TLS protocol availability: ssl3 tls10 tls11 tls12 \r\nSSL/TLS algorithm availability: RSA DSA ECDSA DH ECDH EC\r\nOpenSSL option availability: SSL_OP_NO_COMPRESSION SSL_OP_NO_TICKET SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION SSL_OP_TLS_ROLLBACK_BUG\r\ncompiled against libevent 2.0.21-stable\r\nrtlinked against libevent 2.0.21-stable\r\n4 CPU cores detected\r\nSSL/TLS protocol: negotiate\r\nproxyspecs:\r\n- [0.0.0.0]:8080 tcp http netfilter\r\n- [0.0.0.0]:8443 ssl http netfilter\r\nNo CA loaded.\r\nUsing libevent backend 'epoll'\r\nEvent base supports: edge yes, O(1) yes, anyfd no\r\nInserted events:\r\n  0x250bd20 [fd 6] Read Persist\r\n  0x250c330 [fd 7] Read Persist\r\n  0x250c410 [fd 8] Read Persist\r\n  0x250bb58 [fd 5] Read Persist\r\n  0x250c7d0 [fd 3] Signal Persist\r\n  0x250ca10 [fd 1] Signal Persist\r\n  0x250cb40 [fd 2] Signal Persist\r\n  0x250cc70 [fd 13] Signal Persist\r\nInitialized 8 connection handling threads\r\nStarted 8 connection handling threads\r\nStarting main event loop.\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\nSNI peek: [www.google.de] [complete]\r\nError creating SSL\r\n```\r\n\r\nFF on client says \"Secure connection failed, connection to server was reset while page was loading\". Not sure why sslsplit would want to create an SSL session when it's supposed to only do passthrough. Hope I'm not doing anything wrong. \r\n\r\nBTW, both machines run Ubuntu 14.04. sslsplit was built from git repo. \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/droe/sslsplit/issues/comments/97829234","html_url":"https://github.com/droe/sslsplit/issues/92#issuecomment-97829234","issue_url":"https://api.github.com/repos/droe/sslsplit/issues/92","id":97829234,"user":{"login":"droe","id":749226,"avatar_url":"https://avatars.githubusercontent.com/u/749226?v=3","gravatar_id":"","url":"https://api.github.com/users/droe","html_url":"https://github.com/droe","followers_url":"https://api.github.com/users/droe/followers","following_url":"https://api.github.com/users/droe/following{/other_user}","gists_url":"https://api.github.com/users/droe/gists{/gist_id}","starred_url":"https://api.github.com/users/droe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/droe/subscriptions","organizations_url":"https://api.github.com/users/droe/orgs","repos_url":"https://api.github.com/users/droe/repos","events_url":"https://api.github.com/users/droe/events{/privacy}","received_events_url":"https://api.github.com/users/droe/received_events","type":"User","site_admin":false},"created_at":"2015-04-30T15:01:38Z","updated_at":"2015-04-30T15:01:38Z","body":"I believe this has been fixed, closing the issue. Thanks for the bug report!"}}