netstack.fm

← netstack.fm17 mars · 16 min

Protocol Shorts: MITM Proxies and Transparent L4 Interception

Protocol Shorts: MITM Proxies and Transparent L4 Interception17 mars16 min

<p>episode 31 — Protocol Shorts: MITM Proxies and Transparent L4 Interception.</p><p></p><p>In this second "Protocol Shorts" episode, we look at man-in-the-middle proxies from the transport layer up. The episode explains how HTTP proxies, HTTP CONNECT, and SOCKS5 differ, why they all assume a proxy-aware client, and what changes when a transparent layer 4 proxy is inserted by the operating system instead.</p><p></p><p>From there, we dig into protocol detection from the first bytes on the wire and into the <code>BridgeIo</code> abstraction in Rama: a way to relay and inspect stacked handshakes incrementally instead of terminating every protocol upfront.</p><p></p><p><b>Learn more:</b></p><p></p><ul><li><a rel="noopener noreferrer nofollow" href="https://netstack.fm/#episode-23" target="_blank">https://netstack.fm/#episode-23</a> — Protocol Shorts: HTTP as an Application Bus</li><li><a rel="noopener noreferrer nofollow" href="https://ramaproxy.org/book/proxies/intro.html" target="_blank">https://ramaproxy.org/book/proxies/intro.html</a> — Intro to proxies in the Ramabook</li><li><a rel="noopener noreferrer nofollow" href="https://ramaproxy.org/book/proxies/http.html" target="_blank">https://ramaproxy.org/book/proxies/http.html</a> — HTTP(S) proxies in the Rama boo</li><li><a rel="noopener noreferrer nofollow" href="https://ramaproxy.org/book/proxies/socks5.html" target="_blank">https://ramaproxy.org/book/proxies/socks5.html</a> — SOCKS5 proxies in the Rama book</li><li><a rel="noopener noreferrer nofollow" href="https://ramaproxy.org/book/proxies/mitm.html" target="_blank">https://ramaproxy.org/book/proxies/mitm.html</a> — MITM proxies in the Rama book&lt;/&gt;&lt;/li&gt;</li><li><a rel="noopener noreferrer nofollow" href="https://ramaproxy.org/book/proxies/protocol_inspection.html" target="_blank">https://ramaproxy.org/book/proxies/protocol_inspection.html</a> — Protocolinspection in the Rama book</li><li><a rel="noopener noreferrer nofollow" href="https://ramaproxy.org/book/proxies/operate/transparent.html" target="_blank">https://ramaproxy.org/book/proxies/operate/transparent.html</a> — Operating transparent proxies with Rama</li><li><a rel="noopener noreferrer nofollow" href="https://github.com/plabayo/rama/tree/main/ffi/apple/examples/transparent_proxy" target="_blank">https://github.com/plabayo/rama/tree/main/ffi/apple/examples/transparent_proxy</a> — MacOS Transparent Proxy (Rama) example</li></ul><p></p><p><b>Rama</b></p><p></p><p>If you like this po