Question : How to apply SSLProxy to Suricata inline IDPS?

[samiux]

I am setting up a Suricata inline IDPS with AF-PACKET. It is a 3 network interfaces device, two of the interfaces are without IP address and the other one is for management purpose. The two network interfaces are for capturing traffic from/to internet to/from internet via the Suricata.

My question is how to apply SSLProxy to the Suricata when Suricata does not have any IP address or port? Any suggestion? Thank you.

[sonertari]

The UTMFW project uses Snort as IPS, but SSLproxy requires modification in Snort sources, more specifically I have developed a Snort preprocessor for SSLproxy. See: https://github.com/sonertari/UTMFW/blob/master/ports/distfiles/snort-2.9.20_sslproxy.diff

But there is no such modification for Suricata yet. See: #8

Note that UTMFW uses divert sockets (not network sockets) to divert packets to Snort.

[aregshmavonyan]

Is Snort listening to port 8080 in UTMFW setup? I installed UTMFW and try to make it work in my setup. I see the line preprocessor sslproxy: ports 8080, 8110, 9199 in "snortinline.conf" file. I would like to figure out how SSLproxy forwards the decrypted data to Snort and why we can't do the same with Suricata. Is there smth missing on the current version of Suricata that does not allow this, which Snort allows so that is why you chose Snort?

Thank you

[sonertari]

I have developed an SSLproxy preprocessor for Snort IPS. You can find it in the ports folder of the UTMFW repo.
This preprocessor is needed to parse the SSLproxy line inserted into the first packet of each connection diverted to listening programs.
But Suricata does not support that (yet). See the associated Suricata task too.
Sorry for the late reply.

[sandwichdoge]

@sonertari I just read about your Suricata ICAP integration plan, standardization is the right step ahead because nobody seemed to care about third party integration until recently. But from what I've seen it'll take a lot of work from both SSLProxy and the libsuricata guys. Hope I'll see a workable solution soon.